search

Kyomotoi / ATRI

A project for ATRI, use go-cqhttp and Nonebot2.
https://atri.imki.moe
GNU General Public License v3.0
734 stars 85 forks source link

图片上传等存在SQL注入漏洞 #10

Closed mnixry closed 4 years ago

mnixry commented 4 years ago

https://github.com/Kyomotoi/ATRI/blob/d97d94cfddb7e2ff8869e2ef09d2e2d450c79a80/ATRI/plugins/UploadSqlite.py#L130

如果用户上传的字段是经过精心构造的例如 'test);drop table cloudmusic; 你数据库就没了

我个人建议采用ORM或者使用占位符，不能直接采用字符串替换 以这句为例，应该为 cur.execute('INSERT INTO cloudmusic VALUES (?)',msg)

Kyomotoi commented 4 years ago

已修复，感谢提醒！