[QGIS-Developer] Existing plugin versions should not be marked with "security issues"

[Even Rouault]

Le 17/06/2026 à 18:40, Raymond Nijssen via QGIS-Developer a écrit :
> Hi, I'm having this security issue with Bandit and cannot publish my 
> plugin. But the executeSql() does not take separate parameters. What 
> would be the proper solution here?
>
>
> Possible SQL injection vector through string-based query construction.
> 104             q = f'DELETE FROM imaer_metadata WHERE key = \'{key}\';'
> 105             self.conn.executeSql(q)


Maybe instead of key, use escaped_key = key.replace("'", "''") (ie 
replacing single quote by single quote repeated twice)

That should be enough to avoid SQL injection, but no idea if Bandit will 
be smart enough to recognize this

Some DB backends might have different escaping rules than the above 
standard SQL92 one, so it might be tricky to do that safely against an 
arbitrary backend.

-- 
http://www.spatialys.com
My software is free, but my time generally not.