mirror of
https://github.com/asterisk/asterisk
synced 2026-08-07 10:32:13 -04:00
88c65757b5
The eventtype column handler in cel_pgsql.c inserts record.user_defined_name directly into the SQL query without calling PQescapeStringConn(), while all other string fields in the same function are properly escaped. Similarly, cel_tds.c passes the raw user_defined_name into the SQL INSERT without routing it through anti_injection(), while all other fields are processed through that function. For cel_pgsql.c, escape the eventtype value using PQescapeStringConn(), matching the existing pattern used for all other string fields at lines 308-331 of the same function. For cel_tds.c, route the eventtype value through anti_injection() consistent with how all other fields are handled in the same function. Resolves: #GHSA-ph27-3m5q-mj5m |
||
|---|---|---|
| .. | ||
| cel_beanstalkd.c | ||
| cel_custom.c | ||
| cel_manager.c | ||
| cel_odbc.c | ||
| cel_pgsql.c | ||
| cel_radius.c | ||
| cel_sqlite3_custom.c | ||
| cel_tds.c | ||
| Makefile | ||