Investigate if user supplied input for commands for SQLite are a concern or not #14

New issue

Open

opened 2026-09-06 09:23:56 +10:00 by pascal_nulah · 0 comments

pascal_nulah commented

2026-09-06 09:23:56 +10:00

Owner

Just a ticket to remind me to look into places where I take user supplied input and pass it to paramaterised SQLite query strings.

tbh I don't think I really care as the risk surface for this is if someone can pass a name (in the case of New-GitRepoRegistation -Name [sql injection I guess?]) to do things to the underlying SQLite database. I don't really care because if some bad actor has the capability to do this, they're already able to execute commands from a users terminal/have some degree of arbitrary execution with the same or higher permissions as the user. If someone can already do that, then I consider the risk as "someone has physical access to the device", which is 100% not my problem territory.

thought: Not sure if I should be suspect about this as the value is coming from arbitrary user supplied input, but also it's a local sqlite database and if an attacker has access to the command that could exploit this then they already have the same privileges (or higher) than the current user so it's very who cares to me
Originally posted by @pascal_nulah in #5 (comment)

Just a ticket to remind me to look into places where I take user supplied input and pass it to paramaterised SQLite query strings. tbh I don't think I really care as the risk surface for this is if someone can pass a name (in the case of `New-GitRepoRegistation -Name [sql injection I guess?]`) to do things to the underlying SQLite database. I don't really care because if some bad actor has the capability to do this, they're already able to execute commands from a users terminal/have some degree of arbitrary execution with the same or higher permissions as the user. If someone can already do that, then I consider the risk as "someone has physical access to the device", which is 100% not my problem territory. > thought: Not sure if I should be suspect about this as the value is coming from arbitrary user supplied input, but also it's a local sqlite database and if an attacker has access to the command that could exploit this then they already have the same privileges (or higher) than the current user so it's very who cares to me > _Originally posted by @pascal_nulah in https://moar.ws/git/pascal_nulah/Nulah.PowerShell/pulls/5#issuecomment-69_

pascal_nulah added the

discussion

label

2026-09-06 09:24:06 +10:00