sounds scary to me :)


On 9 April 2014 07:37, Greg Kempe <notifications@github.com> wrote:

> In censusreporter/api/controller.py:
>
> > @@ -158,6 +159,33 @@ class LocationNotFound(Exception):
> >  }
> >
> >
> > +def get_geography(geo_code, geo_level):
> > +    """
> > +    Get a geography model (Ward, Province, etc.) for this geography, or
> > +    raise LocationNotFound if it doesn't exist.
> > +    """
> > +    session = get_session()
> > +
> > +    try:
> > +        try:
> > +            model = {
> > +                'ward': models.Ward,
> > +                'district': models.District,
> > +                'province': models.Province,
> > +                'municipality': models.Municipality,
> > +            }[geo_level]
>
> My concern is that it's bordering on an injection attack. This geo level
> is passed in directly by the user, and we're then letting them lookup any
> symbol in the global namespace. It's unlikely to have an impact but it
> doesn't feel safe to me.
>
> --
> Reply to this email directly or view it on GitHub<https://github.com/Code4SA/censusreporter/pull/2/files#r11423312>
> .
>



-- 
Adi Eyal
Director
Code for South Africa
Promoting informed decision-making

phone: +27 78 014 2469
skype: adieyalcas
linkedin: http://za.linkedin.com/pub/dir/Adi/Eyal
web: http://www.code4sa.org
twitter: @soapsudtycoon

For more information on how to participate in the open data community in
South Africa, go to: http://www.code4sa.org/#community