JetBrains-Research / pubtrends

Scientific literature explorer. Runs a Pubmed or Semantic Scholar search and allows user to explore high-level structure of result papers
Apache License 2.0
36 stars 2 forks source link

Possible security breach on incorrect request #158

Closed olegs closed 5 years ago

olegs commented 5 years ago

Lookup ffsdfsaffsfsad on Pubtrends.

worker_1  | [2019-08-29 18:17:08,516: INFO/MainProcess] Received task: analyze_async[129a4d57-5f49-4952-8116-e74cb81b37ae]
worker_1  | [2019-08-29 18:17:09,463: INFO/ForkPoolWorker-4] Found 0 publications matching <ffsdfsaffsfsad>
worker_1  | [2019-08-29 18:17:09,465: INFO/ForkPoolWorker-4] Selecting 10000 most cited articles
worker_1  | [2019-08-29 18:17:09,473: ERROR/ForkPoolWorker-4] Task analyze_async[129a4d57-5f49-4952-8116-e74cb81b37ae] raised unexpected: ProgrammingError('syntax error at or near ")"\nLINE 3:                     WITH vals(pmid) AS (VALUES )\n                                                       ^\n')
worker_1  | Traceback (most recent call last):
worker_1  |   File "/home/user/miniconda3/envs/pubtrends/lib/python3.7/site-packages/celery/app/trace.py", line 385, in trace_task
worker_1  |     R = retval = fun(*args, **kwargs)
worker_1  |   File "/home/user/miniconda3/envs/pubtrends/lib/python3.7/site-packages/celery/app/trace.py", line 648, in __protected_call__
worker_1  |     return self.run(*args, **kwargs)
worker_1  |   File "/home/user/models/celery/tasks.py", line 38, in analyze_async
worker_1  |     sort=SORT_METHODS[sort], task=current_task)
worker_1  |   File "/home/user/models/keypaper/analysis.py", line 44, in launch
worker_1  |     current=1, task=task)
worker_1  |   File "/home/user/models/keypaper/pm_loader.py", line 42, in search
worker_1  |     self.ids, temp_table_created = self.sort_results(self.ids, limit, sort, current, task)
worker_1  |   File "/home/user/models/keypaper/pm_loader.py", line 70, in sort_results
worker_1  |     cursor.execute(query)
worker_1  | psycopg2.ProgrammingError: syntax error at or near ")"
worker_1  | LINE 3:                     WITH vals(pmid) AS (VALUES )
olegs commented 5 years ago

Closing as obsolete since we escape all the queries and limit min number of words.