remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-12 11:34:06 +02:00
Code Issues Projects Releases Packages Wiki Activity

escape_sqlite() against column names

Browse source 
Refs GHSA-jcvx-2fh3-pjfp

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
This commit is contained in:
Simon Willison 2026-09-03 14:36:37 -07:00
commit c899beaebe
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
datasette/views/table.py
View file

@ -1382,7 +1382,9 @@ class TableDropView(BaseView):
"database": database_name,
"table": table_name,
"row_count": (
await db.execute(f"select count(*) from [{table_name}]")
await db.execute(
f"select count(*) from {escape_sqlite(table_name)}"
)
).single_value(),
"message": 'Pass "confirm": true to confirm',
},
@ -2432,9 +2434,12 @@ async def _next_value_and_url(
except IndexError:
# sort/sort_desc column missing from SELECT - look up value by PK instead
prefix_where_clause = " and ".join(
f"[{pk}] = :pk{i}" for i, pk in enumerate(pks)
f"{escape_sqlite(pk)} = :pk{i}" for i, pk in enumerate(pks)
)
prefix_lookup_sql = (
f"select {escape_sqlite(sort or sort_desc)} "
f"from {escape_sqlite(table_name)} where {prefix_where_clause}"
)
prefix_lookup_sql = f"select [{sort or sort_desc}] from [{table_name}] where {prefix_where_clause}"
prefix = (
await db.execute(
prefix_lookup_sql,