Closed maxachis closed 1 month ago
Just need to make sure it doesn't break tests, I had issues with pytest using parameterized queries before
With the backend transformations and the addition of security linting, I think we can consider this issue reasonably resolved. We can reopen this if the issue occurs again.
Context
Currently, SQL code in the repository uses string formatting to insert parameters into queries. For example, on quick_search_query.py :
Direct insertions pose a risk for SQL injection attacks.
A solution to this, compatible with psycopg2, is parameterized queries, which will enable these to be inserted without introducing security vulnerabilities.
Requirements
quick_search_query.py
andsecurity.py
will need to be addressed in separate PRs.data_sources.py
include string interpolation in SELECT clause, which will need to be separately handled, possibly as part of a larger refactor