Skip to content

fix(arangodb): parameterize AQL query in UpdateUsers [H6]#554

Merged
lakhansamani merged 1 commit into
mainfrom
fix/h6-aql-injection
Apr 4, 2026
Merged

fix(arangodb): parameterize AQL query in UpdateUsers [H6]#554
lakhansamani merged 1 commit into
mainfrom
fix/h6-aql-injection

Conversation

@lakhansamani
Copy link
Copy Markdown
Contributor

@lakhansamani lakhansamani commented Apr 3, 2026

Summary

  • H6 (High): User IDs were string-interpolated into AQL queries — AQL injection
  • Now uses bindVars (@ids, @DaTa) for parameterized queries

Test plan

  • Package compiles
  • Test UpdateUsers with ArangoDB backend
@lakhansamani
fix(arangodb): parameterize AQL query in UpdateUsers
cf652d8 
User IDs were spliced directly into AQL with fmt.Sprintf, enabling
AQL injection. Now uses bindVars (@ids, @DaTa) for parameterized queries,
consistent with all other ArangoDB queries in the codebase.

Fixes: H6 (High)
@lakhansamani lakhansamani merged commit d2d9431 into main Apr 4, 2026
@lakhansamani lakhansamani deleted the fix/h6-aql-injection branch April 4, 2026 05:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant

@lakhansamani