Upstream
/
harbor
mirror of https://github.com/goharbor/harbor.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #14220 from wy65701436/fix-codeql-quota 

fix quota dao sql injection
This commit is contained in:
Daniel Jiang 2021-02-10 10:34:54 +08:00 committed by GitHub
parent 76c493b67d 496a178eb3
commit 51c8375425
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/pkg/quota/dao/util.go
View File

@ -17,6 +17,7 @@ package dao
import (
"encoding/json"
"fmt"
"github.com/lib/pq"
"strings"
"github.com/goharbor/harbor/src/lib/orm"
@ -104,7 +105,7 @@ func listOrderBy(query *q.Query) string {
if strings.HasPrefix(sort, prefix) {
resource := strings.TrimPrefix(sort, prefix)
if types.IsValidResource(types.ResourceName(resource)) {
field := fmt.Sprintf("%s->>'%s'", strings.TrimSuffix(prefix, "."), resource)
field := fmt.Sprintf("%s->>%s", strings.TrimSuffix(prefix, "."), pq.QuoteLiteral(resource))
orderBy = fmt.Sprintf("(%s) %s", castQuantity(field), order)
break
}