T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:568- Finding
SQL Statement Injection Through Unescaped SQLite Schema Identifiers
- Content
View full analysis
0 ? idxInfo[0].values.map((r) => r[2]) : []; indexes.push({ name: idxName, columns: cols }); } // Check if any index is a prefix of another for (let i = 0; i < indexes.length; i++) { for (let j = 0; j < indexes.length; j++) { if (i === j) continue; const a = indexes[i].columns; const b = indexes[j].columns; if (a.length < b.length && a.every((col, k) => col === b[k])) { duplicates.push({ table: t, redundant: indexes[i].name, kept: indexes[j].name }); } } } } return duplicates; } ``` Additional vulnerable SQLite metadata queries use the same interpolation pattern: ```js for (const t of report.tables) { const fks = db.exec(`PRAGMA foreign_key_list('${t}')`); const idxList = db.exec(`PRAGMA index_list('${t}')`); if (idxList.length > 0) { for (const idxRow of idxList[0].values) { const idxName = idxRow[1]; const idxInfo = db.exec(`PRAGMA index_info('${idxName}')`); if (idxInfo.length > 0) { for (const colRow of idxInfo[0].values) { indexedColumns.add(`${t}.${colRow[2]}`.toLowerCase()); } } } } } // Tables without primary keys for (const t of report.tables) { const info = db.exec(`PRAGMA table_info('${t}')`); if (info.length > 0) { ...[truncated 3906 chars]- Remediation
View remediation