3 ms·
Line 53 of https://github.com/fastmonkeys/stellar/blob/master/stellar/operations.py https://github.com/fastmonkeys/stellar/blob/master/stellar/o... is
by swehner 12y ago
Line 53 of https://github.com/fastmonkeys/stellar/blob/master/stellar/operations.py https://github.com/fastmonkeys/stellar/blob/master/stellar/o... is
CREATE TABLE %s.%s LIKE %s.%s
This made me think of a table called
create table `a; drop table users;` (col int);
... which works in mysql.
I don't know if the stellar code will trip over something like this. But mysql (SQL) shouldn't even allow names like that.
- obsession 12y agoYes, Stellar will probably trip over this. Similarly, if the attacker can edit stellar.yaml, they probably can edit your .bashrc as well. Im adding this to my TODO list.