| https://github.com/simonw/datasette/issues/39#issuecomment-339406634 |
https://api.github.com/repos/simonw/datasette/issues/39 |
339406634 |
MDEyOklzc3VlQ29tbWVudDMzOTQwNjYzNA== |
9599 |
2017-10-25T17:27:10Z |
2017-10-25T17:27:10Z |
OWNER |
It certainly looks like some of the stuff in https://sqlite.org/pragma.html could be used to screw around with things. Example: `PRAGMA case_sensitive_like = 1` - would that affect future queries? |
{"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} |
268469569 |
|
| https://github.com/simonw/datasette/issues/39#issuecomment-339413825 |
https://api.github.com/repos/simonw/datasette/issues/39 |
339413825 |
MDEyOklzc3VlQ29tbWVudDMzOTQxMzgyNQ== |
9599 |
2017-10-25T17:48:48Z |
2017-10-25T17:48:48Z |
OWNER |
Could I use https://sqlparse.readthedocs.io/en/latest/ to parse incoming statements and ensure they are pure SELECTs? Would that prevent people from using a compound SELECT statement to trigger an evil PRAGMA of some sort? |
{"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} |
268469569 |
|
| https://github.com/simonw/datasette/issues/39#issuecomment-339510770 |
https://api.github.com/repos/simonw/datasette/issues/39 |
339510770 |
MDEyOklzc3VlQ29tbWVudDMzOTUxMDc3MA== |
9599 |
2017-10-26T00:07:40Z |
2017-10-26T00:07:40Z |
OWNER |
It looks like I should double quote my columns and ensure they are correctly escaped https://blog.christosoft.de/2012/10/sqlite-escaping-table-acolumn-names/ - hopefully using ? placeholders for column names will work. I should use ? for tables too. |
{"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} |
268469569 |
|
| https://github.com/simonw/datasette/issues/39#issuecomment-340787868 |
https://api.github.com/repos/simonw/datasette/issues/39 |
340787868 |
MDEyOklzc3VlQ29tbWVudDM0MDc4Nzg2OA== |
9599 |
2017-10-31T14:54:14Z |
2017-10-31T14:54:14Z |
OWNER |
Here’s how I can (I think) provide safe execution of arbitrary SQL while blocking PRAGMA calls: let people use names parameters in their SQL and apply strict filtering to the SQL query but not to the parameter values.
cur.execute(
"select * from people where name_last=:who and age=:age", {
"who": who,
"age": age
})
In URL form:
?sql=select...&who=Terry&age=34
Now we can apply strict, dumb validation rules to the SQL part while allowing anything in the named queries - so people can execute a search for PRAGMA without being able to execute a PRAGMA statement. |
{"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} |
268469569 |
|