- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
ID: python-flask/sqlalchemy-injection
Language: Python
Severity: Error
Category: Security
Use of unsanitized data from incoming requests in SQL queries may lead to SQL injections. Instead, the data should be filtered and sanitized before use, making sure all potential SQL injections are avoided.
import flask
import requests
app = flask.Flask(__name__)
@app.route("/route/to/resource/<resource_id>")
def resource2(resource_id):
file1 = query.order_by(resource_id)
file2 = query.having(f"{resource_id}")
@app.route("/route/to/resource/<resource_id>")
def resource3(resource_id):
file3 = query.filter("{0}".format(resource_id))
@app.route("/route/to/resource")
def resource2():
resource_id = flask.request.args.get("resource_id")
file1 = query.group_by(resource_id)
import flask
import requests
app = flask.Flask(__name__)
@app.route("/route/to/resource")
def resource2():
resource_id = flask.request.args.get("resource_id")
file1 = query.group_by(sanitize(resource_id))
|
|
For more information, please read the Code Analysis documentation
Identify code vulnerabilities directly in yourVS Code editor
Identify code vulnerabilities directly inJetBrains products