Fix security issue: Unrestricted SQL Query Execution Through Raw Query Interface (CWE-89)
This commit is contained in:
parent
ecbabbd261
commit
eaa6ff2f65
1 changed files with 2 additions and 18 deletions
|
|
@ -396,23 +396,7 @@ class SQLAlchemyAdapter:
|
||||||
rows = result.mappings().all()
|
rows = result.mappings().all()
|
||||||
return rows
|
return rows
|
||||||
|
|
||||||
async def execute_query(self, query):
|
# The unsafe execute_query method has been removed due to SQL injection risk.
|
||||||
"""
|
|
||||||
Execute a raw SQL query against the database asynchronously.
|
|
||||||
|
|
||||||
Parameters:
|
|
||||||
-----------
|
|
||||||
|
|
||||||
- query: The SQL query string to execute.
|
|
||||||
|
|
||||||
Returns:
|
|
||||||
--------
|
|
||||||
|
|
||||||
The result set as a list of dictionaries, with each dictionary representing a row.
|
|
||||||
"""
|
|
||||||
async with self.engine.begin() as connection:
|
|
||||||
result = await connection.execute(text(query))
|
|
||||||
return [dict(row) for row in result]
|
|
||||||
|
|
||||||
async def drop_tables(self):
|
async def drop_tables(self):
|
||||||
"""
|
"""
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue