Vulnerabilities Dashboard - Code

[nullify-proactiveops]

Severity Threshold: 🔵 MEDIUM

1 Potential vulnerability sources found within this repo

🔴 CRITICAL	🟡 HIGH	🔵 MEDIUM	⚪ LOW
1	0	0	0

ID: 01JB0Q1PJ1QGZX8SAEBX3E99H1 Language: Go Severity: 🔴 CRITICAL CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SQL Injection is a critical vulnerability that can lead to data or system compromise. By dynamically generating SQL query strings, user input may be able to influence the logic of the SQL statement. This could lead to an adversary accessing information they should not have access to or in some circumstances, being able to execute OS functionality or code.
Read more:
https://cwe.mitre.org/data/definitions/89.html

opa_lambda/lambda/policyevaluator/policyevaluator.go

Line 41 in 9a20252

rego.Query("data."+policyName),

Reply with /nullify to interact with me like another developer

[skwashd]

/nullify this isn't a SQL query. It is an Open Policy Agent query. The concatenated string is setting the name of query properly.