pocolifo / noter-backend

0 stars 0 forks source link

Use FastAPI or SQLAlchemy models rather than functions in makeobjects #11

Closed YoungerMax closed 1 year ago

YoungerMax commented 1 year ago

The functions in makeobjects.py create objects insecurely. If an attacker include a ", the attacker could escape the string and overwrite data in the object. By using FastAPI models or the SQLAlchemy equivalent, this bug is patched and it follows the intended use of models

deanOcoin commented 1 year ago

Fixed by just using dictionaries instead of string formatting to fix this bug.