mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
12 lines
367 B
Python
12 lines
367 B
Python
|
"""Split-sink SQL injection: query is built, then executed on the next line."""
|
||
|
|
from flask import Flask, request
|
||
|
|
|
||
|
|
app = Flask(__name__)
|
||
|
|
|
||
|
|
|
||
|
|
@app.get("/search")
|
||
|
|
def search(db):
|
||
|
|
term = request.args["q"]
|
||
|
|
query = "select * from items where title like '%" + term + "%'"
|
||
|
|
return db.execute(query) # CWE-89 split-sink: query built on prior line (regex blind spot)
|