vault: deal with SQL injection possibilities from `query`
rohany opened this issue · 3 comments
rohany commented
The query
command currently takes in a raw SQL expression to apply to the existing instances. A malicious user could mess up internal vault state with a SQL injection attack.
rohany commented
Now that #17 has landed, all that remains here is to ensure that we properly escape values within strings input to the Vault DSL.
rohany commented
rohany commented
I don't think that this is actually possible in the current status of the DSL.