Upstream/harbor
1
0
Fork 0
mirror of https://github.com/goharbor/harbor.git synced 2025-02-02 13:01:23 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #14220 from wy65701436/fix-codeql-quota

Browse Source 
fix quota dao sql injection
This commit is contained in:
Daniel Jiang 2021-02-10 10:34:54 +08:00 committed by GitHub
commit 51c8375425
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/pkg/quota/dao/util.go
View File

@ -17,6 +17,7 @@ package dao
import (
"encoding/json"
"fmt"
"github.com/lib/pq"
"strings"
"github.com/goharbor/harbor/src/lib/orm"
@ -104,7 +105,7 @@ func listOrderBy(query *q.Query) string {
if strings.HasPrefix(sort, prefix) {
resource := strings.TrimPrefix(sort, prefix)
if types.IsValidResource(types.ResourceName(resource)) {
field := fmt.Sprintf("%s->>'%s'", strings.TrimSuffix(prefix, "."), resource)
field := fmt.Sprintf("%s->>%s", strings.TrimSuffix(prefix, "."), pq.QuoteLiteral(resource))
orderBy = fmt.Sprintf("(%s) %s", castQuantity(field), order)
break
}