mirror of
https://github.com/simonw/sqlite-utils.git
synced 2026-08-12 20:34:11 +02:00
2d3c6b9a1eThe tokenize value passed to Table.enable_fts() was interpolated directly into the CREATE VIRTUAL TABLE statement inside a single-quoted string literal. A value containing a single quote could break out of that literal and inject arbitrary SQL, which executes via executescript(). This is reachable from the CLI via 'enable-fts --tokenize'. Route the value through the existing Database.quote() helper so SQLite itself escapes it. Legitimate tokenizers such as 'porter' are unaffected. Adds a regression test. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| __main__.py | ||
| cli.py | ||
| create_table_parser.py | ||
| db.py | ||
| hookspecs.py | ||
| migrations.py | ||
| plugins.py | ||
| py.typed | ||
| recipes.py | ||
| utils.py | ||