{"action":"created","issue":{"url":"https://api.github.com/repos/gogits/gogs/issues/2892","repository_url":"https://api.github.com/repos/gogits/gogs","labels_url":"https://api.github.com/repos/gogits/gogs/issues/2892/labels{/name}","comments_url":"https://api.github.com/repos/gogits/gogs/issues/2892/comments","events_url":"https://api.github.com/repos/gogits/gogs/issues/2892/events","html_url":"https://github.com/gogits/gogs/issues/2892","id":143825334,"number":2892,"title":"Insecure database queries","user":{"login":"joepie91","id":1663259,"avatar_url":"https://avatars.githubusercontent.com/u/1663259?v=3","gravatar_id":"","url":"https://api.github.com/users/joepie91","html_url":"https://github.com/joepie91","followers_url":"https://api.github.com/users/joepie91/followers","following_url":"https://api.github.com/users/joepie91/following{/other_user}","gists_url":"https://api.github.com/users/joepie91/gists{/gist_id}","starred_url":"https://api.github.com/users/joepie91/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joepie91/subscriptions","organizations_url":"https://api.github.com/users/joepie91/orgs","repos_url":"https://api.github.com/users/joepie91/repos","events_url":"https://api.github.com/users/joepie91/events{/privacy}","received_events_url":"https://api.github.com/users/joepie91/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/gogits/gogs/labels/help%20wanted","name":"help wanted","color":"009800"},{"url":"https://api.github.com/repos/gogits/gogs/labels/kind/security","name":"kind/security","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":32,"created_at":"2016-03-27T16:31:24Z","updated_at":"2016-04-12T15:41:55Z","closed_at":null,"body":"The Gogs codebase seems to be very inconsistent in how it generates queries. There are entire [chunks of code](https://github.com/gogits/gogs/blob/master/models/issue.go#L801-L842) where parameterized queries are used alongside string-concatenated queries, and this [has led to SQL injection vulnerabilities in the past](https://www.cvedetails.com/vulnerability-list/vendor_id-14955/product_id-30369/opsqli-1/Gogits-Gogs.html).\r\n\r\nIs there any particular reason why Gogs isn't using parameterized queries *everywhere*? Given that all major databases now support them, it's kind of shocking to me that this isn't already the case, and makes me rather concerned about deploying Gogs on my system, security-wise."},"comment":{"url":"https://api.github.com/repos/gogits/gogs/issues/comments/208968666","html_url":"https://github.com/gogits/gogs/issues/2892#issuecomment-208968666","issue_url":"https://api.github.com/repos/gogits/gogs/issues/2892","id":208968666,"user":{"login":"tboerger","id":156964,"avatar_url":"https://avatars.githubusercontent.com/u/156964?v=3","gravatar_id":"","url":"https://api.github.com/users/tboerger","html_url":"https://github.com/tboerger","followers_url":"https://api.github.com/users/tboerger/followers","following_url":"https://api.github.com/users/tboerger/following{/other_user}","gists_url":"https://api.github.com/users/tboerger/gists{/gist_id}","starred_url":"https://api.github.com/users/tboerger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tboerger/subscriptions","organizations_url":"https://api.github.com/users/tboerger/orgs","repos_url":"https://api.github.com/users/tboerger/repos","events_url":"https://api.github.com/users/tboerger/events{/privacy}","received_events_url":"https://api.github.com/users/tboerger/received_events","type":"User","site_admin":false},"created_at":"2016-04-12T15:41:55Z","updated_at":"2016-04-12T15:41:55Z","body":"So https://github.com/gogits/gogs/pull/2895 should resolve all remaining issues, please review that."}}