[Security] SQL Injection Vulnerability in datasets and tasks routers

[MOHITKOURAV01]

Describe the bug

A critical security vulnerability was identified in the list_datasets and task lookup functions within the routers. The application was using raw string concatenation (f-strings) to build SQL queries from user-provided input.

This creates a high-risk SQL Injection (SQLi) vulnerability, allowing a malicious user to manipulate the query structure and execute unauthorized database commands, leading to potential data loss or unauthorized access.

To Reproduce

Steps to reproduce the behavior:

1. Send a request to the /datasets/list endpoint.
2. Provide a tag parameter containing malicious SQL syntax, for example:
   'study_14'); DROP TABLE dataset; --
3. Result: The server concatenates this string directly into the query, which would attempt to drop the dataset table.

Expected behavior

User input must always be treated as data, never as part of the SQL command structure. All database interactions should:

• Use parameterized placeholders (Bind Parameters).
• Strictly validate any dynamic table or column names against a predefined whitelist.

Additional context

This vulnerability was found in the following files:

• src/routers/openml/datasets.py
• src/routers/openml/tasks.py

Status: A fix has already been implemented in the branch feature/sql-parameterization and is ready for review.