SQL injection is possible

[pixelbender]

Using fmt.Sprintf from a user input data:
https://github.com/nuveo/prest/blob/master/adapters/postgres/postgres.go#L58
and then calling postgres.Query:
https://github.com/nuveo/prest/blob/master/controllers/databases.go#L25
is a very bad practice that allows to user make SQL injections.

[felipeweb]

@pixelbender thanks for reporting. Do you want to send a pull request fixing the issue?

[crgimenes]

Hello guys, I'll take care of this problem.
Suggestions are welcome.

... Complementing ...
The idea is to change WhereByRequest to return two results, the first is a string with the where clause and the second a string array containing the values that will be processed via Prepare.

I will use the same solution in other parts of the code that are also vulnerable.

Other entries such as field names can also be attacked, in these cases I will simply check if it contains invalid characters and returns error if I find a semicolon, quotes, etc.

[avelino]

@pixelbender thanks for reporting this bug, we at @nuveo wasn't thinking that initially because it would use the pREST in private network (no public access), we will put priority on this bug.