CVE-2024-25722 (Python, published 2024-02-11T05:15Z)
Description: value: qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/netease-youdao/QAnything
Files changed:
qanything_kernel/connector/database/mysql/mysql_client.py
Commit message: fix: Prevent SQL injection attacks.


Vulnerable code:
        kb_ids_str = ','.join("'{}'".format(str(x)) for x in kb_ids)
        query = "SELECT kb_id FROM KnowledgeBase WHERE kb_id IN ({}) AND deleted = 0 AND user_id = %s".format(kb_ids_str)
        result = self.execute_query_(query, (user_id,), fetch=True)
    
            batch_file_names = file_names[i:i+batch_size]
            file_names_str = ','.join("'{}'".format(str(x).replace("'", "\\'")) for x in batch_file_names)
            """.format(file_names_str)
            
            # 这里假设 execute_query_ 是一个可以执行SQL查询并提交或获取结果的方法
            batch_result = self.execute_query_(query, (kb_id, user_id), fetch=True)
            debug_logger.info("check_file_exist_by_name batch {}: {}".format(i//batch_size, batch_result))
        kb_ids_str = ','.join("'{}'".format(str(x)) for x in kb_ids)
        query = "SELECT user_id, kb_id, kb_name FROM KnowledgeBase WHERE kb_id IN ({}) AND deleted = 0".format(kb_ids_str)
        return self.execute_query_(query, (), fetch=True)
        # 删除知识库
        kb_ids_str = ','.join("'{}'".format(str(x)) for x in kb_ids)
        query = "UPDATE KnowledgeBase SET deleted = 1 WHERE user_id = %s AND kb_id IN ({})".format(kb_ids_str)
        self.execute_query_(query, (user_id,), commit=True)
        # 删除知识库下面的文件
        query = """UPDATE File SET deleted = 1 WHERE kb_id IN ({}) AND kb_id IN (SELECT kb_id FROM KnowledgeBase WHERE user_id = %s)""".format(kb_ids_str)
        self.execute_query_(query, (user_id,), commit=True)

Fixed code:
        # 使用参数化查询
        placeholders = ','.join(['%s'] * len(kb_ids))
        query = "SELECT kb_id FROM KnowledgeBase WHERE kb_id IN ({}) AND deleted = 0 AND user_id = %s".format(
            placeholders)
        query_params = kb_ids + [user_id]
        result = self.execute_query_(query, query_params, fetch=True)

            batch_file_names = file_names[i:i + batch_size]
            placeholders = ','.join(['%s'] * len(batch_file_names))
            """.format(placeholders)

            query_params = batch_file_names + [kb_id, user_id]
            batch_result = self.execute_query_(query, query_params, fetch=True)
            debug_logger.info("check_file_exist_by_name batch {}: {}".format(i // batch_size, batch_result))
        # 使用参数化查询
        placeholders = ','.join(['%s'] * len(kb_ids))
        query = "SELECT user_id, kb_id, kb_name FROM KnowledgeBase WHERE kb_id IN ({}) AND deleted = 0".format(placeholders)
        query_params = kb_ids
        return self.execute_query_(query, query_params, fetch=True)
        # 使用参数化查询
        placeholders = ','.join(['%s'] * len(kb_ids))
        query = "UPDATE KnowledgeBase SET deleted = 1 WHERE user_id = %s AND kb_id IN ({})".format(placeholders)
        query_params = [user_id] + kb_ids
        self.execute_query_(query, query_params, commit=True)

        # 更新文件的删除状态也需要使用参数化查询
        query = "UPDATE File SET deleted = 1 WHERE kb_id IN ({}) AND kb_id IN (SELECT kb_id FROM KnowledgeBase WHERE user_id = %s)".format(placeholders)
        self.execute_query_(query, query_params, commit=True)