fix(albums): sanitize image_ids and secure IN clause #629
Conversation
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
backend/app/database/albums.py (2)
199-207: Remove redundant commit.Line 205's manual
conn.commit()is unnecessary. Theget_db_connection()context manager (line 189) automatically commits on successful exit, as shown in the connection.py snippet.Apply this diff:
[(album_id, img_id) for img_id in valid_images], ) - conn.commit() else:
209-209: Remove trailing whitespace.Line 209 contains trailing whitespace.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
backend/app/database/albums.py(1 hunks)
🧰 Additional context used
🧬 Code graph analysis (1)
backend/app/database/albums.py (1)
backend/app/database/connection.py (1)
get_db_connection(8-32)
🔇 Additional comments (1)
backend/app/database/albums.py (1)
172-177: Good input validation.The type check ensures
image_idsis a list before processing, preventing type-related errors early.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
backend/app/database/albums.py (3)
194-201: Optional: Simplify by removing unreachable else clause.The
if sanitized_ids:check is redundant because line 187-188 already raisesValueErrorif the list is empty. The else clause (lines 200-201) is unreachable dead code.Apply this diff to simplify:
- # Efficient single query with parameterized IN clause - if sanitized_ids: - # Generate placeholders safely based on list length - placeholders = ",".join(["?"] * len(sanitized_ids)) - query = f"SELECT id FROM images WHERE id IN ({placeholders})" - cursor.execute(query, sanitized_ids) # Pass string IDs directly - valid_images = [row[0] for row in cursor.fetchall()] - else: - valid_images = [] + # Efficient single query with parameterized IN clause + # Generate placeholders safely based on list length + placeholders = ",".join(["?"] * len(sanitized_ids)) + query = f"SELECT id FROM images WHERE id IN ({placeholders})" + cursor.execute(query, sanitized_ids) # Pass string IDs directly + valid_images = [row[0] for row in cursor.fetchall()]Note: The security approach is excellent - placeholders derived from sanitized list length and all values parameterized correctly prevents SQL injection.
206-211: Optional: Remove redundant explicit commit.The
executemanyapproach with parameterized query is secure and efficient. However, the explicitconn.commit()on line 211 is redundant because theget_db_connection()context manager already commits on successful exit (seeconnection.pyline 28).Apply this diff:
# Insert into album_images using executemany cursor.executemany( "INSERT OR IGNORE INTO album_images (album_id, image_id) VALUES (?, ?)", [(album_id, img_id) for img_id in valid_images], ) - conn.commit()The context manager will handle the commit automatically, making the code cleaner and more consistent with other functions using
get_db_connection()(likedb_delete_albumanddb_remove_image_from_album).
213-213: Nitpick: Remove trailing whitespace.This line appears to contain only whitespace characters.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
backend/app/database/albums.py(1 hunks)
🧰 Additional context used
🧬 Code graph analysis (1)
backend/app/database/albums.py (1)
backend/app/database/connection.py (1)
get_db_connection(8-32)
🔇 Additional comments (4)
backend/app/database/albums.py (4)
171-175: Excellent security documentation.The docstring clearly communicates the security approach and UUID support, making the function's behavior transparent to other developers.
176-178: Good defensive validation.Type checking the input prevents runtime errors downstream and provides clear feedback to callers.
180-188: Proper string sanitization that maintains UUID support.The validation correctly keeps IDs as strings, strips whitespace, and raises a clear error when no valid IDs are provided. This addresses the past feedback about integer conversion breaking UUID functionality.
203-204: Clear error handling for non-existent IDs.Explicitly raising an error when none of the IDs exist provides better feedback than silently succeeding with no changes.
1 participant
closes #608
Summary
Fix potential SQL injection in db_add_images_to_album by sanitizing
image_idsand using parameterized IN clause safely.Changes
image_idsto be integers (skip invalid)executemanyto insert rows safelyTests
pytestpasses locallySummary by CodeRabbit