Use bound parameters in search_invoices
Fix PRs are off for this repo. Copy the patch below.Fixes CWE-89: SQL built with string formatting in app.db.db.conn.execute()
What it changes: Passes customer and status as bound parameters through db.fetch_all instead of formatting them into the SQL string, so quotes in the input can no longer change the query.
How it was checked: Re-scanned the patched code: PY-SEC-003 no longer fires.
--- a/app/services/billing.py+++ b/app/services/billing.py@@ -19,7 +19,9 @@return [dict(r) for r in rows]def search_invoices(self, customer: str, status: str = "open") -> list[dict]:- query = f"SELECT * FROM invoices WHERE customer_email = '{customer}' AND status = '{status}'"- rows = db.conn.execute(query).fetchall()+ rows = db.fetch_all(+ "SELECT * FROM invoices WHERE customer_email = ? AND status = ?",+ (customer, status),+ )return [dict(r) for r in rows]