douliao7354
2019-01-09 20:25
采纳率: 0%
浏览 292

如何防止PostgreSQL JSON / JSONB字段中的SQL注入?

How can I prevent SQL injection attacks in Go while using "database/sql"?

This solves the single value field problem because you can remove the quotes, but I can't do that filtering a JSON/JSONB field, like in the following because the $1 is considered a string:

`SELECT * FROM foo WHERE bar @> '{"baz": "$1"}'`

The following works but it's prone to SQL Injection:

`SELECT * FROM foo WHERE bar @> '{"baz": "` + "qux" + `"}'`

How do I solve this?


EDITED after @mkopriva's comment:

How would I build this json [{"foo": $1}] with the jsonb_* functions? Tried the below without success:

jsonb_build_array(0, jsonb_build_object('foo', $1::text))::jsonb

There's no sql error. The filter just doesn't work. There's a way that I can check the builded sql? I'm using the database/sql native lib.

  • 写回答
  • 好问题 提建议
  • 关注问题
  • 收藏
  • 邀请回答

1条回答 默认 最新

  • duanhuang7591 2019-01-10 07:32
    已采纳

    Is this what you're looking for?

    type MyStruct struct {
        Baz string
    }
    
    func main() {
        db, err := sql.Open("postgres", "postgres://...")
        if err != nil {
            log.Panic(err)
        }
    
        s := MyStruct{
            Baz: "qux",
        }
    
        val, _ := json.Marshal(s)
        if err != nil {
            log.Panic(err)
        }
    
        if _, err := db.Exec("SELECT * FROM foo WHERE bar @> ?", val); err != nil {
            log.Panic(err)
        }
    }
    

    As a side note, Exec isn't for retrieval (although I kept it for you so the solution would match your example). Check out db.Query (Fantastic tutorial here: http://go-database-sql.org/retrieving.html)

    已采纳该答案
    评论
    解决 无用
    打赏 举报

相关推荐 更多相似问题