{"action":"opened","issue":{"url":"https://api.github.com/repos/NCEAS/metacat/issues/1069","repository_url":"https://api.github.com/repos/NCEAS/metacat","labels_url":"https://api.github.com/repos/NCEAS/metacat/issues/1069/labels{/name}","comments_url":"https://api.github.com/repos/NCEAS/metacat/issues/1069/comments","events_url":"https://api.github.com/repos/NCEAS/metacat/issues/1069/events","html_url":"https://github.com/NCEAS/metacat/issues/1069","id":302404145,"number":1069,"title":"sql injection bug in EventLog.getD1Record()","user":{"login":"mbjones","id":766407,"avatar_url":"https://avatars0.githubusercontent.com/u/766407?v=4","gravatar_id":"","url":"https://api.github.com/users/mbjones","html_url":"https://github.com/mbjones","followers_url":"https://api.github.com/users/mbjones/followers","following_url":"https://api.github.com/users/mbjones/following{/other_user}","gists_url":"https://api.github.com/users/mbjones/gists{/gist_id}","starred_url":"https://api.github.com/users/mbjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbjones/subscriptions","organizations_url":"https://api.github.com/users/mbjones/orgs","repos_url":"https://api.github.com/users/mbjones/repos","events_url":"https://api.github.com/users/mbjones/events{/privacy}","received_events_url":"https://api.github.com/users/mbjones/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/NCEAS/metacat/milestones/29","html_url":"https://github.com/NCEAS/metacat/milestone/29","labels_url":"https://api.github.com/repos/NCEAS/metacat/milestones/29/labels","id":3162497,"number":29,"title":"2.4.2","description":null,"creator":{"login":"mbjones","id":766407,"avatar_url":"https://avatars0.githubusercontent.com/u/766407?v=4","gravatar_id":"","url":"https://api.github.com/users/mbjones","html_url":"https://github.com/mbjones","followers_url":"https://api.github.com/users/mbjones/followers","following_url":"https://api.github.com/users/mbjones/following{/other_user}","gists_url":"https://api.github.com/users/mbjones/gists{/gist_id}","starred_url":"https://api.github.com/users/mbjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbjones/subscriptions","organizations_url":"https://api.github.com/users/mbjones/orgs","repos_url":"https://api.github.com/users/mbjones/repos","events_url":"https://api.github.com/users/mbjones/events{/privacy}","received_events_url":"https://api.github.com/users/mbjones/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":17,"state":"open","created_at":"2018-03-05T16:30:46Z","updated_at":"2018-03-05T18:08:22Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2018-03-05T18:08:22Z","updated_at":"2018-03-05T18:08:22Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"---\n\n\nAuthor Name: **Matt Jones** (Matt Jones)\nOriginal Redmine Issue: 6644, https://projects.ecoinformatics.org/ecoinfo/issues/6644\nOriginal Date: 2015-01-08\nOriginal Assignee: ben leinfelder\n\n---\n\nThere is a SQL injection bug in getD1Record due to the use of unsantized user input in the database sql command that is constructed via string concatenation.  In general, it is never safe to use string concatenation with user input, and as a local function never can really know when function arguments might have originated from an unsafe source, we should always instead use PreparedStatements with parameter bindings.  In a previous relelase of Metacat we had expunged all such usages, but it appears this new function was built later.  It needs to be refactored ASAP to use PreparedStatements and parameter binding rather than string appends.\n\n\n"}}
{"actor":{"display_login":"mbjones"}}