vault: deal with SQL injection possibilities from `query`

Question

vault: deal with SQL injection possibilities from `query`

rohany opened this issue 4 years ago · 3 comments

The query command currently takes in a raw SQL expression to apply to the existing instances. A malicious user could mess up internal vault state with a SQL injection attack.

Answer 1 · 2020-12-09T05:04:25.000Z

Now that #17 has landed, all that remains here is to ensure that we properly escape values within strings input to the Vault DSL.

Answer 2 · 2020-12-09T07:47:23.000Z

https://github.com/cockroachdb/cockroach/blob/d62d1ba46c7d382d1402911d2d6b24257bc3d08b/pkg/sql/lex/encode.go#L65

Answer 3 · 2020-12-10T00:41:44.000Z

I don't think that this is actually possible in the current status of the DSL.