Use sql parameters instead of potential sql injection.

jahav · Oct 3, 2024 · 0471bd6 · 0471bd6
1 parent 8bc2ccf
commit 0471bd6
Showing 1 changed file with 9 additions and 7 deletions.
diff --git a/src/DataIsland.SqlServer/SqlDatabaseTenantFactory.cs b/src/DataIsland.SqlServer/SqlDatabaseTenantFactory.cs
@@ -113,13 +113,15 @@ private static List<BackupFile> GetLogicalFiles(SqlConnection connection, string
         // TODO: Don't do on every tenant
         var logicalFiles = new List<BackupFile>();
         var query = connection.CreateCommand();
-        query.CommandText = $"""
-                RESTORE FILELISTONLY
-                FROM DISK = N'{EscapePath(diskPath)}'
-                WITH
-                    FILE = {file},
-                    NOUNLOAD
-""";
+        query.CommandText = """
+                            RESTORE FILELISTONLY
+                            FROM DISK = @path
+                            WITH
+                                FILE = @file,
+                                NOUNLOAD
+                            """;
+        query.Parameters.Add("@path", SqlDbType.NVarChar, 1024).Value = diskPath;
+        query.Parameters.Add("@file", SqlDbType.Int).Value = file;
         using var reader = query.ExecuteReader();
         var logicalNameOrdinal = reader.GetOrdinal("LogicalName");
         var typeOrdinal = reader.GetOrdinal("Type");