GitToTheHub commented on PR #313: URL: https://github.com/apache/cordova-paramedic/pull/313#issuecomment-5095215594
Hi. I do not think this is a legitimate critical SQL injection issue in the current threat model. The values used in these SQL statements are controlled by the tool’s own runtime flow (fixed app id and fixed service list), not attacker-supplied input, so the CWE-89 severity claim looks overstated here. Also, this is not about template string literals themselves. Template literals are fine to keep. The real question is whether untrusted data can reach the query, and in this path that does not appear to be the case. I would classify this as optional hardening/defense-in-depth, not a critical security fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
