Fix security issue: Unrestricted SQL Query Execution Through Raw Query Interface (CWE-89)
This commit is contained in:
parent
ecbabbd261
commit
eaa6ff2f65
1 changed files with 2 additions and 18 deletions
|
|
@ -396,23 +396,7 @@ class SQLAlchemyAdapter:
|
|||
rows = result.mappings().all()
|
||||
return rows
|
||||
|
||||
async def execute_query(self, query):
|
||||
"""
|
||||
Execute a raw SQL query against the database asynchronously.
|
||||
|
||||
Parameters:
|
||||
-----------
|
||||
|
||||
- query: The SQL query string to execute.
|
||||
|
||||
Returns:
|
||||
--------
|
||||
|
||||
The result set as a list of dictionaries, with each dictionary representing a row.
|
||||
"""
|
||||
async with self.engine.begin() as connection:
|
||||
result = await connection.execute(text(query))
|
||||
return [dict(row) for row in result]
|
||||
# The unsafe execute_query method has been removed due to SQL injection risk.
|
||||
|
||||
async def drop_tables(self):
|
||||
"""
|
||||
|
|
@ -592,4 +576,4 @@ class SQLAlchemyAdapter:
|
|||
f"Missing value in foreign key information. \nColumn value: {col}\nReference column value: {ref_col}\n"
|
||||
)
|
||||
|
||||
return schema
|
||||
return schema
|
||||
Loading…
Add table
Reference in a new issue