administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-03-17 21:58:22 +03:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

fix: use parameterized query in get_face_ids to prevent SQL injection (#22500)

Browse Source 
The name parameter was interpolated directly into the SQL query via
f-string, allowing SQL injection through crafted face name values.

Use a parameterized query with ? placeholder instead.
This commit is contained in:
ryzendigo 2026-03-17 07:23:44 +08:00 committed by GitHub
parent 722ef6a1fe
commit aea91a91d5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
frigate/embeddings/__init__.py
View File

@ -205,14 +205,14 @@ class EmbeddingsContext:
)
def get_face_ids(self, name: str) -> list[str]:
sql_query = f"""
sql_query = """
SELECT
id
FROM vec_descriptions
WHERE id LIKE '%{name}%'
WHERE id LIKE ?
"""
return self.db.execute_sql(sql_query).fetchall()
return self.db.execute_sql(sql_query, (f"%{name}%",)).fetchall()
def reprocess_face(self, face_file: str) -> dict[str, Any]:
return self.requestor.send_data(