SQL injection vulnerability

[mccalluc]

    query = """
        SELECT importance, chrOffset, fields FROM intervals
        WHERE fields LIKE '%{}%'
        ORDER BY importance DESC
        LIMIT 10
        """.format(text)

    rows = c.execute(query).fetchall()

Maybe something upstream is santitizing text, but still, this is not good. Use the ? instead.

[mccalluc]

@pkerpedjiev. Here's a fix, I think. (I checked out the project, and realize now I don't have write privs, and would make a fork, but I should head out.) (also make the list building more idiomatic.)

    query = """
        SELECT importance, chrOffset, fields FROM intervals
        WHERE fields LIKE '%?%'
        ORDER BY importance DESC
        LIMIT 10
        """

    rows = c.execute(query, text).fetchall()

    to_return = []
    for (importance, chrOffset, fields) in rows:
        field_parts = fields.split('\t')
        to_return.append({
                      'chr': field_parts[0],
                      'txStart': int(field_parts[1]),
                      'txEnd': int(field_parts[2]),
                      'score': importance,
                      'geneName': field_parts[3]})
    return to_return

[pkerpedjiev]

You should have write privileges now. And no, text is not being sanitized. It comes directly from the search box. I presume c.execute() does some sanitization when the parameter is passed in through there?

[mccalluc]

Yeah: using execute to pass in parameters is the way to avoid injection attacks.

On a second look: I don't think syntactically LIKE '%?%' is going to work... Let me get it running locally, and try LIKE '%' || ? || '%'...