Skip to content

fix(arangodb): parameterize AQL query in UpdateUsers [H6]#554

Merged
lakhansamani merged 1 commit intomainfrom
fix/h6-aql-injection
Apr 4, 2026
Merged

fix(arangodb): parameterize AQL query in UpdateUsers [H6]#554
lakhansamani merged 1 commit intomainfrom
fix/h6-aql-injection

Conversation

@lakhansamani
Copy link
Copy Markdown
Contributor

@lakhansamani lakhansamani commented Apr 3, 2026

Summary

  • H6 (High): User IDs were string-interpolated into AQL queries — AQL injection
  • Now uses bindVars (@ids, @DaTa) for parameterized queries

Test plan

  • Package compiles
  • Test UpdateUsers with ArangoDB backend

@lakhansamani
fix(arangodb): parameterize AQL query in UpdateUsers
cf652d8 
User IDs were spliced directly into AQL with fmt.Sprintf, enabling
AQL injection. Now uses bindVars (@ids, @DaTa) for parameterized queries,
consistent with all other ArangoDB queries in the codebase.

Fixes: H6 (High)
@lakhansamani lakhansamani merged commit d2d9431 into main Apr 4, 2026
@lakhansamani lakhansamani deleted the fix/h6-aql-injection branch April 4, 2026 05:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lakhansamani