Details
-
Type:
Bug
-
Status:
Open
-
Priority:
Major
-
Resolution: Unresolved
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: None
-
Labels:None
-
Number of attachments :
Description
Uploading the attached layer through the rest api fails with a SQL parsing error. I think there's potential for a SQL injection attack here.
I guess the code that's failing is the call to create schema?
Hmm... looking at the code we are already wrapping the name in ' ', but that's exactly why it's happening.
Now... what to do about this? Just refuse to create the table? Or can we escape the ' and let it go?