Skip to content

Commit 3a5f003

Browse files
committed
fix(security): SQL issues
# Conflicts: # src/core/store/postgresql.py
1 parent 27f6715 commit 3a5f003

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

src/core/store/postgresql.py

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,8 @@ def store(self, table_name, value_column, value_column_value, worker_column, wor
109109
print("Value stored successfully!")
110110
elif table_name == "user_message_inbox_perceptually_similar":
111111
self.cur.execute(
112-
f"""INSERT INTO {table_name} ({value_column}, {worker_column}) VALUES (%s, %s)""",
113-
(value_column_value, worker_column_value),
112+
"INSERT INTO %s (%s, %s) VALUES (%s, %s)",
113+
(table_name, value_column, worker_column, value_column_value, worker_column_value),
114114
)
115115
self.conn.commit()
116116
print(f"Value stored successfully in {table_name}!")
@@ -133,8 +133,9 @@ def update(self, table_name, value_column, id_value, value_column_new_value, wor
133133
pass
134134
elif table_name == "user_message_inbox_perceptually_similar":
135135
self.cur.execute(
136-
f"""UPDATE {table_name} SET {value_column} = %s, {worker_column} = %s WHERE id = %s""",
137-
(value_column_new_value, worker_column_new_value, id_value),
136+
"UPDATE %s SET %s = %s, %s = %s WHERE id = %s",
137+
(table_name, value_column, value_column_new_value,
138+
worker_column, worker_column_new_value, id_value),
138139
)
139140
self.conn.commit()
140141
print(f"Value updated successfully in {table_name}!")
@@ -148,8 +149,8 @@ def delete(self, table_name, column_name, id_value):
148149
if self.cur:
149150
try:
150151
self.cur.execute(
151-
f"""DELETE FROM {table_name} WHERE {column_name} = %s""",
152-
(id_value,),
152+
"DELETE FROM %s WHERE %s = %s",
153+
(table_name, column_name, id_value,),
153154
)
154155
self.conn.commit()
155156
print("Value deleted successfully!")

0 commit comments

Comments
 (0)