Chapter 2.1: SQL Injection - fix

[nxvl]

Fix

Given that we have seen that the way this injection works is by breaking out of the ''s, we can use PostgreSQL escaping E'\''. For that we change our SQL query and replace every occurrence of ' with \':

        sql = "INSERT INTO listings (title, description) VALUES (E'%s', E'%s')" % (
            title.replace("'", "\\'"), description.replace("'", "\\'")
        )

With that our test now pass:

(venv) > $ pytest --tb=short
================================================================================================== test session starts ===================================================================================================
platform linux -- Python 3.5.3, pytest-5.0.0, py-1.8.0, pluggy-0.12.0
rootdir: {...}
collected 1 item
tests/test_listings.py .                                                                                                                                                                                           [100%]
================================================================================================ 1 passed in 0.95 seconds ================================================================================================

But this is not sufficient, if we modify our payload to be injection\', (select version()))-- - our query will end up being:

INSERT INTO listings (title, description) VALUES (E'injection\\', (select version()))-- -', E'\'')

and attacker will still be able to exploit our app.