Le 17/06/2026 à 18:40, Raymond Nijssen via QGIS-Developer a écrit :
Hi, I'm having this security issue with Bandit and cannot publish my
plugin. But the executeSql() does not take separate parameters. What
would be the proper solution here?
Possible SQL injection vector through string-based query construction.
104 q = f'DELETE FROM imaer_metadata WHERE key = \'{key}\';'
105 self.conn.executeSql(q)
Maybe instead of key, use escaped_key = key.replace("'", "''") (ie
replacing single quote by single quote repeated twice)
That should be enough to avoid SQL injection, but no idea if Bandit will
be smart enough to recognize this
Some DB backends might have different escaping rules than the above
standard SQL92 one, so it might be tricky to do that safely against an
arbitrary backend.
--
http://www.spatialys.com
My software is free, but my time generally not.
_______________________________________________
QGIS-Developer mailing list
[email protected]
List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
