Skip to content

wrap logical predicate into () to prevent possible SQL attack

Pavlo Mashliakovskiy requested to merge fix/logicalPredicateAttack into master

In case expression is like below, all AND parts (for example appended by RLS) are ignored

UB.Repository('uba_user').attrs('ID').where('ID', '>', 1, 'a1').where('ID', '>', 1, 'a2').logic('[a1] OR [a2]').select()

Merge request reports

Loading