You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi, when our server which is made of mongo-sql was scaned by our security department, they told us there is some risk of sql injection. After checking the code of "order"(mongo-sql/helpers/query/order.js), I found that:
Hi, @csucrab Thanks for bringing this up. There are actually a number of risks I'd like to mitigate, and this is one of them. If you can submit a PR, that'd be great! Otherwise, I'll get to this as soon as I can.
jrf0110
changed the title
"order" has the risk of sql injection
Re-write order helper to mitigate potential SQL injections
Dec 29, 2016
Hi, when our server which is made of mongo-sql was scaned by our security department, they told us there is some risk of sql injection. After checking the code of "order"(mongo-sql/helpers/query/order.js), I found that:
I think meybey call escape funciton with key and order[key] is better here?
The text was updated successfully, but these errors were encountered: