Remove potential SQL injection

STARIONGROUP · Jan 20, 2025 · dc1760e · dc1760e
1 parent 7be1a27
commit dc1760e
Showing 1 changed file with 10 additions and 6 deletions.
diff --git a/CometServer/Modules/10-25/ExchangeFileImportApi.cs b/CometServer/Modules/10-25/ExchangeFileImportApi.cs
@@ -1077,15 +1077,16 @@ private void DropDataStoreAndPrepareNew(IDataStoreController dataStoreController
                 connection.Open();
 
                 // Drop the existing database
-                using (var cmd = new NpgsqlCommand())
+                using (var cmd = new NpgsqlCommand("", connection))
                 {
                     this.logger.LogDebug("Drop the data store");
 
                     dataStoreController.DropDataStoreConnections(backtierConfig.Database, connection);
 
                     cmd.Connection = connection;
 
-                    cmd.CommandText = $"DROP DATABASE IF EXISTS {backtierConfig.Database};";
+                    cmd.CommandText = "DROP DATABASE IF EXISTS (@databaseName);";
+                    cmd.Parameters.AddWithValue("databaseName", backtierConfig.Database);
 
                     cmd.ExecuteNonQuery();
                 }
@@ -1096,8 +1097,8 @@ private void DropDataStoreAndPrepareNew(IDataStoreController dataStoreController
                     this.logger.LogDebug("Drop the restore data store");
 
                     cmd.Connection = connection;
-
-                    cmd.CommandText = $"DROP DATABASE IF EXISTS {backtierConfig.DatabaseRestore};";
+                    cmd.CommandText = "DROP DATABASE IF EXISTS (@databaseRestoreName);";
+                    cmd.Parameters.AddWithValue("databaseRestoreName", backtierConfig.DatabaseRestore);
 
                     cmd.ExecuteNonQuery();
                 }
@@ -1107,8 +1108,11 @@ private void DropDataStoreAndPrepareNew(IDataStoreController dataStoreController
                 {
                     this.logger.LogDebug("Create the data store");
                     cmd.Connection = connection;
-
-                    cmd.CommandText = $"CREATE DATABASE {backtierConfig.Database} WITH OWNER = {backtierConfig.UserName} TEMPLATE = {backtierConfig.DatabaseManage} ENCODING = 'UTF8';";
+
+                    cmd.CommandText = "CREATE DATABSE (@databaseName) WITH OWNER = (@owner) TEMPLATE = (@databaseManager) ENCODING = UTF8;";
+                    cmd.Parameters.AddWithValue("databaseName", backtierConfig.Database);
+                    cmd.Parameters.AddWithValue("owner", backtierConfig.UserName);
+                    cmd.Parameters.AddWithValue("databaseManager", backtierConfig.DatabaseManage);
 
                     cmd.ExecuteNonQuery();
                 }