Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent SQL injection attacks #13

Open
mpuckett159 opened this issue Apr 24, 2021 · 0 comments
Open

Prevent SQL injection attacks #13

mpuckett159 opened this issue Apr 24, 2021 · 0 comments

Comments

@mpuckett159
Copy link
Owner

I was surprised to find that I had already done like 99% of the work to prevent SQL injection attacks, but still need to cover my last base. Explanation as follows:

Flow of data when joining a meeting:

  1. User provides meeting ID(!) and their name
  2. Internal websocket hub is looked up using supplied meeting ID
  3. User is joined to the meeting hub and a websocket connection is established
  4. The current contents of the database are fetched and returned to the users using the supplied meeting ID(!!)

The fix is fairly simple, surprisingly. I just need to use the hub struct found by the supplied meeting ID (https://github.com/mpuckett159/stack-web-app/blob/master/wshandler/client.go#L257) to provide back the hubId property of the hub struct (https://github.com/mpuckett159/stack-web-app/blob/master/wshandler/client.go#L290) and that will prevent any user input from ever reaching the tableId part of the sql query, thus preventing any potential SQL injections on my side of the code. So the code change will just be:

stackUsers, err := db.ShowCurrentStack(hub.hubId) at https://github.com/mpuckett159/stack-web-app/blob/master/wshandler/client.go#L290

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant