Repository: jobatabs/textec
Issue category: Security Vulnerability

Issue:
Fix code scanning alert - SQL doesn't use :symbols
Tracking issue for:
- [x] https://github.com/jobatabs/textec/security/code-scanning/3



Hints:

Patch:
diff --git a/src/repositories/reference_repository.py b/src/repositories/reference_repository.py
index 7768842..6d0d67b 100644
--- a/src/repositories/reference_repository.py
+++ b/src/repositories/reference_repository.py
@@ -34,14 +34,14 @@ def delete_reference(_id):
     db.session.commit()
 
 
-def create_reference(references: dict):  # toimiiko???
+def create_reference(references: dict):
     filtered_references = {key: value for key,
                            value in references.items() if value is not None}
 
-    keys = ", ".join(filtered_references.keys())
-    values = ", ".join(f":{key}" for key in filtered_references.keys())
+    prepended_keys = [f":{key}" for key in filtered_references.keys()]
 
-    sql = text(f"INSERT INTO reference_items ({keys}) VALUES ({values})")
+    sql = text(f'INSERT INTO reference_items ({", ".join(filtered_references.keys())}) \
+               VALUES ({", ".join(prepended_keys)})')
 
     db.session.execute(sql, filtered_references)
     db.session.commit()


Test patch: