machankura/mempool
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix possible mysql injectin in channels.api

Browse Source
This commit is contained in:
nymkappa 2022-08-31 08:53:21 +02:00
parent 9131521e7d
commit 08833b08a0
No known key found for this signature in database
GPG Key ID: E155910B16E8BD04
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
backend/src/api/explorer/channels.api.ts
View File

@ -229,9 +229,14 @@ class ChannelsApi {
public async $getChannelsByTransactionId(transactionIds: string[]): Promise<any[]> { public async $getChannelsByTransactionId(transactionIds: string[]): Promise<any[]> {
try { try {
transactionIds = transactionIds.map((id) => '\'' + id + '\''); const query = `
const query = `SELECT n1.alias AS alias_left, n2.alias AS alias_right, channels.* FROM channels LEFT JOIN nodes AS n1 ON n1.public_key = channels.node1_public_key LEFT JOIN nodes AS n2 ON n2.public_key = channels.node2_public_key WHERE channels.transaction_id IN (${transactionIds.join(', ')}) OR channels.closing_transaction_id IN (${transactionIds.join(', ')})`; SELECT n1.alias AS alias_left, n2.alias AS alias_right, channels.*
const [rows]: any = await DB.query(query); FROM channels
LEFT JOIN nodes AS n1 ON n1.public_key = channels.node1_public_key
LEFT JOIN nodes AS n2 ON n2.public_key = channels.node2_public_key
WHERE channels.transaction_id IN ? OR channels.closing_transaction_id IN ?
`;
const [rows]: any = await DB.query(query, [[transactionIds], [transactionIds]]);
const channels = rows.map((row) => this.convertChannel(row)); const channels = rows.map((row) => this.convertChannel(row));
return channels; return channels;
} catch (e) { } catch (e) {