Security: SQL Injection via String Formatting in SQLiteExtractor

[tomaioo]

Summary

Security: SQL Injection via String Formatting in SQLiteExtractor

Problem

Severity: High | File: src/graphnet/data/extractors/internal/sqlite_extractor.py:L35

The SQLiteExtractor.__call__ method constructs SQL queries using Python f-strings with direct string interpolation for table names and event lists. While event_nos uses map(str, event_nos) which converts to strings, the _extractor_name is used directly in the query without sanitization. If an attacker can control the extractor name, they could inject malicious SQL. More critically, the event_list is joined with commas but not parameterized, and the table name is directly interpolated.

Solution

Use parameterized queries with ? placeholders instead of string formatting. For the IN clause, use a parameterized approach: query = f'SELECT * FROM {self._extractor_name} WHERE event_no IN ({','.join('?' * len(event_nos))})' and pass event_nos as parameters to pd.read_sql_query. Also validate _extractor_name against a whitelist of allowed table names.

Changes

• src/graphnet/data/extractors/internal/sqlite_extractor.py (modified)