Fix VAmPI username SQL injection

models/user_model.py

@@ -5,7 +5,6 @@
 from app import vuln, alive
 from models.books_model import Book
 from random import randrange
-from sqlalchemy.sql import text
 
 
 class User(db.Model):
@@ -68,17 +67,7 @@ def get_all_users_debug():
 
     @staticmethod
     def get_user(username):
-        if vuln:  # SQLi Injection
-            user_query = f"SELECT * FROM users WHERE username = '{username}'"
-            query = db.session.execute(text(user_query))
-            ret = query.fetchone()
-            if ret:
-                fin_query = '{"username": "%s", "email": "%s"}' % (ret[1], ret[3])
-            else:
-                fin_query = None
-        else:
-            fin_query = User.query.filter_by(username=username).first()
-        return fin_query
+        return User.query.filter_by(username=username).first()
 
     @staticmethod
     def register_user(username, password, email, admin=False):

tests/test_username_sqli.py

@@ -0,0 +1,7 @@
+from pathlib import Path
+
+
+def test_username_lookup_uses_orm_filtering():
+    source = Path("models/user_model.py").read_text()
+    assert "f\"SELECT * FROM users WHERE username" not in source
+    assert "User.query.filter_by(username=username).first()" in source