shkong/go-cqhttp
1
0
Fork 0
mirror of https://github.com/Mrs4s/go-cqhttp.git synced 2025-05-04 19:17:37 +08:00
Code Issues Projects Releases Wiki Activity

fix: possible sql inject

Browse Source
This commit is contained in:
源文雨 2022-11-09 21:10:20 +08:00
parent cee4bccf45
commit fc51a69ff1
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
db/sqlite3/sqlite3.go
View File

@ -4,6 +4,7 @@
package sqlite3 package sqlite3
import ( import (
"encoding/base64"
"encoding/json" "encoding/json"
"hash/crc64" "hash/crc64"
"os" "os"
@ -179,10 +180,14 @@ func (s *database) GetPrivateMessageByGlobalID(id int32) (*db.StoredPrivateMessa
} }
func (s *database) GetGuildChannelMessageByID(id string) (*db.StoredGuildChannelMessage, error) { func (s *database) GetGuildChannelMessageByID(id string) (*db.StoredGuildChannelMessage, error) {
_, err := base64.StdEncoding.DecodeString(id)
if err != nil {
return nil, errors.Wrap(err, "query invalid id error")
}
var ret db.StoredGuildChannelMessage var ret db.StoredGuildChannelMessage
var guildmsg StoredGuildChannelMessage var guildmsg StoredGuildChannelMessage
s.RLock() s.RLock()
err := s.db.Find(Sqlite3GuildChannelMessageTableName, &guildmsg, "WHERE ID='"+id+"'") err = s.db.Find(Sqlite3GuildChannelMessageTableName, &guildmsg, "WHERE ID='"+id+"'")
s.RUnlock() s.RUnlock()
if err != nil { if err != nil {
return nil, errors.Wrap(err, "query error") return nil, errors.Wrap(err, "query error")