darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2025-12-16 10:12:32 -05:00
Code Issues Packages Projects Releases Wiki Activity

notify-api-91 sanitize SQL inputs against injection

Browse Source
This commit is contained in:
Kenneth Kehl
2023-07-14 09:07:23 -07:00
parent 4417838b09
commit e6077c187c
7 changed files with 61 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
migrations/versions/0348_migrate_broadcast_settings_migrate_broadcast_settings.py
View File

@@ -34,13 +34,17 @@ def upgrade():
services = conn.execute(find_services_sql)
for service in services:
setting = conn.execute(f"SELECT service_id, channel, provider FROM service_broadcast_settings WHERE service_id = '{service.id}';").first()
input_params = {"service_id": service.id}
setting = conn.execute(
"SELECT service_id, channel, provider FROM service_broadcast_settings WHERE service_id=:service_id;",
input_params).first()
if setting:
print(f"Service {service.id} already has service_broadcast_settings. No action required")
else:
channel = "severe" if service.restricted else "test"
print(f"Service {service.id} does not have service_broadcast_settings. Will insert one with channel {channel}")
conn.execute(f"INSERT INTO service_broadcast_settings (service_id, channel, created_at) VALUES ('{service.id}', '{channel}', now());")
conn.execute("INSERT INTO service_broadcast_settings (service_id, channel, created_at) VALUES (%s, %s, now());",
{service.id, channel})
def downgrade():