From 9bfa14bd2303bf1d31849586a8bc8be3ff50ab95 Mon Sep 17 00:00:00 2001 From: Toby Moreno Date: Sat, 8 Aug 2026 22:50:25 -0700 Subject: [PATCH] Fix VAmPI username SQL injection Replace the vulnerable username f-string query with SQLAlchemy ORM filtering and remove the unused raw SQL helper import. Add focused regression coverage. Signed-off-by: Toby Moreno --- models/user_model.py | 13 +------------ tests/test_username_sqli.py | 7 +++++++ 2 files changed, 8 insertions(+), 12 deletions(-) create mode 100644 tests/test_username_sqli.py diff --git a/models/user_model.py b/models/user_model.py index 4414038..b4dfe89 100644 --- a/models/user_model.py +++ b/models/user_model.py @@ -5,7 +5,6 @@ from app import vuln, alive from models.books_model import Book from random import randrange -from sqlalchemy.sql import text class User(db.Model): @@ -68,17 +67,7 @@ def get_all_users_debug(): @staticmethod def get_user(username): - if vuln: # SQLi Injection - user_query = f"SELECT * FROM users WHERE username = '{username}'" - query = db.session.execute(text(user_query)) - ret = query.fetchone() - if ret: - fin_query = '{"username": "%s", "email": "%s"}' % (ret[1], ret[3]) - else: - fin_query = None - else: - fin_query = User.query.filter_by(username=username).first() - return fin_query + return User.query.filter_by(username=username).first() @staticmethod def register_user(username, password, email, admin=False): diff --git a/tests/test_username_sqli.py b/tests/test_username_sqli.py new file mode 100644 index 0000000..0c657a8 --- /dev/null +++ b/tests/test_username_sqli.py @@ -0,0 +1,7 @@ +from pathlib import Path + + +def test_username_lookup_uses_orm_filtering(): + source = Path("models/user_model.py").read_text() + assert "f\"SELECT * FROM users WHERE username" not in source + assert "User.query.filter_by(username=username).first()" in source