T09 · Insecure Skill Coding Practices
Error
- Location
database_ops.py:93- Finding
SQL injection through interpolated identifiers and predicates
- Content
View full analysis
int: """插入数据""" columns = ', '.join(data.keys()) placeholders = ', '.join(['?' for _ in data]) sql = f'INSERT INTO {table} ({columns}) VALUES ({placeholders})' ``` ```python # database_ops.py:116-130 def update(self, table: str, data: Dict, where: str, params: tuple = None) -> int: """更新数据""" set_clause = ', '.join([f'{k} = ?' for k in data.keys()]) sql = f'UPDATE {table} SET {set_clause} WHERE {where}' values = tuple(data.values()) + (params or ()) with self.get_cursor() as cursor: cursor.execute(sql, values) return cursor.rowcount def delete(self, table: str, where: str, params: tuple = None) -> int: """删除数据""" sql = f'DELETE FROM {table} WHERE {where}' ``` ```python # database_ops.py:244-246 def export_to_json(db_path: str, table: str, output_path: str = None) -> str: """导出表到JSON""" with DatabaseOps(db_path) as db: data = db.execute(f'SELECT * FROM {table}') ``` ```python # mysql_ops.py:128-131 def count(self, table: str, where: str = None) -> int: """统计行数""" sql = f'SELECT COUNT(*) as cnt FROM {table}' if where: sql += f' WHERE {where}' ``` ```python # extra_db.py:48-49 def get_columns(self, table): return [r[0] for r in self.execute(f"SELECT column_name FROM information_schema.columns WHERE table_name='{table}'")] ``` ### Technical Analysis SQL value placeholders protect only bound values. They do not protect table names, column names, or raw SQL predicate fragments. The affected methods interpolate the following caller-controlled inputs directly into SQL statements: - Table names - Dic ...[truncated 1857 chars]- Remediation
View remediation