Fix security issue: Unrestricted SQL Query Execution Through Raw Query Interface (CWE-89)

This commit is contained in:
pensarapp[bot] 2025-06-09 16:59:24 +00:00 committed by GitHub
parent ecbabbd261
commit eaa6ff2f65
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -396,23 +396,7 @@ class SQLAlchemyAdapter:
rows = result.mappings().all()
return rows
async def execute_query(self, query):
"""
Execute a raw SQL query against the database asynchronously.
Parameters:
-----------
- query: The SQL query string to execute.
Returns:
--------
The result set as a list of dictionaries, with each dictionary representing a row.
"""
async with self.engine.begin() as connection:
result = await connection.execute(text(query))
return [dict(row) for row in result]
# The unsafe execute_query method has been removed due to SQL injection risk.
async def drop_tables(self):
"""
@ -592,4 +576,4 @@ class SQLAlchemyAdapter:
f"Missing value in foreign key information. \nColumn value: {col}\nReference column value: {ref_col}\n"
)
return schema
return schema