Upstream/harbor
1
0
Fork 0
mirror of https://github.com/goharbor/harbor.git synced 2024-11-22 18:25:56 +01:00
Code Issues Projects Releases Wiki Activity

fix quota dao sql injection

Browse Source 
Signed-off-by: Wang Yan <wangyan@vmware.com>
This commit is contained in:
Wang Yan 2021-02-09 17:42:29 +08:00
parent 21d35f9702
commit 496a178eb3
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/pkg/quota/dao/util.go
View File

@ -17,6 +17,7 @@ package dao
import (
"encoding/json"
"fmt"
"github.com/lib/pq"
"strings"
"github.com/goharbor/harbor/src/lib/orm"
@ -104,7 +105,7 @@ func listOrderBy(query *q.Query) string {
if strings.HasPrefix(sort, prefix) {
resource := strings.TrimPrefix(sort, prefix)
if types.IsValidResource(types.ResourceName(resource)) {
field := fmt.Sprintf("%s->>'%s'", strings.TrimSuffix(prefix, "."), resource)
field := fmt.Sprintf("%s->>%s", strings.TrimSuffix(prefix, "."), pq.QuoteLiteral(resource))
orderBy = fmt.Sprintf("(%s) %s", castQuantity(field), order)
break
}