darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2026-09-05 07:38:24 -04:00
Code Issues Packages Projects Releases Wiki Activity

Verify potential sql-injection findings are false positives

Browse Source
This commit is contained in:
Ryan Ahearn
2022-08-18 19:07:54 +00:00
parent e77cedb039
commit 53f2519c2a
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
app/commands.py
View File

@@ -151,8 +151,8 @@ def backfill_notification_statuses():
`Notification._status_enum` `Notification._status_enum`
""" """
LIMIT = 250000 LIMIT = 250000
subq = "SELECT id FROM notification_history WHERE notification_status is NULL LIMIT {}".format(LIMIT) subq = "SELECT id FROM notification_history WHERE notification_status is NULL LIMIT {}".format(LIMIT) # nosec B608 no user-controlled input
update = "UPDATE notification_history SET notification_status = status WHERE id in ({})".format(subq) update = "UPDATE notification_history SET notification_status = status WHERE id in ({})".format(subq) # nosec B608 no user-controlled input
result = db.session.execute(subq).fetchall() result = db.session.execute(subq).fetchall()
while len(result) > 0: while len(result) > 0:
@@ -169,7 +169,7 @@ def update_notification_international_flag():
""" """
# 250,000 rows takes 30 seconds to update. # 250,000 rows takes 30 seconds to update.
subq = "select id from notifications where international is null limit 250000" subq = "select id from notifications where international is null limit 250000"
update = "update notifications set international = False where id in ({})".format(subq) update = "update notifications set international = False where id in ({})".format(subq) # nosec B608 no user-controlled input
result = db.session.execute(subq).fetchall() result = db.session.execute(subq).fetchall()
while len(result) > 0: while len(result) > 0:
@@ -180,7 +180,7 @@ def update_notification_international_flag():
# Now update notification_history # Now update notification_history
subq_history = "select id from notification_history where international is null limit 250000" subq_history = "select id from notification_history where international is null limit 250000"
update_history = "update notification_history set international = False where id in ({})".format(subq_history) update_history = "update notification_history set international = False where id in ({})".format(subq_history) # nosec B608 no user-controlled input
result_history = db.session.execute(subq_history).fetchall() result_history = db.session.execute(subq_history).fetchall()
while len(result_history) > 0: while len(result_history) > 0:
db.session.execute(update_history) db.session.execute(update_history)
@@ -201,8 +201,8 @@ def fix_notification_statuses_not_in_sync():
""" """
MAX = 10000 MAX = 10000
subq = "SELECT id FROM notifications WHERE cast (status as text) != notification_status LIMIT {}".format(MAX) subq = "SELECT id FROM notifications WHERE cast (status as text) != notification_status LIMIT {}".format(MAX) # nosec B608 no user-controlled input
update = "UPDATE notifications SET notification_status = status WHERE id in ({})".format(subq) update = "UPDATE notifications SET notification_status = status WHERE id in ({})".format(subq) # nosec B608 no user-controlled input
result = db.session.execute(subq).fetchall() result = db.session.execute(subq).fetchall()
while len(result) > 0: while len(result) > 0:
@@ -211,9 +211,8 @@ def fix_notification_statuses_not_in_sync():
db.session.commit() db.session.commit()
result = db.session.execute(subq).fetchall() result = db.session.execute(subq).fetchall()
subq_hist = "SELECT id FROM notification_history WHERE cast (status as text) != notification_status LIMIT {}" \ subq_hist = "SELECT id FROM notification_history WHERE cast (status as text) != notification_status LIMIT {}".format(MAX) # nosec B608
.format(MAX) update = "UPDATE notification_history SET notification_status = status WHERE id in ({})".format(subq_hist) # nosec B608 no user-controlled input
update = "UPDATE notification_history SET notification_status = status WHERE id in ({})".format(subq_hist)
result = db.session.execute(subq_hist).fetchall() result = db.session.execute(subq_hist).fetchall()
while len(result) > 0: while len(result) > 0: