Parameterize all queries, format queries

onionr/core.py

@@ -132,7 +132,7 @@ class Core:
         c = conn.cursor()
         t = (peerID, name, 'unknown', hashID, powID, 0)
 
-        for i in c.execute("SELECT * FROM PEERS where id = ?;", (peerID,)):
+        for i in c.execute("SELECT * FROM peers WHERE id = ?;", (peerID,)):
             try:
                 if i[0] == peerID:
                     conn.close()
@@ -160,7 +160,7 @@ class Core:
             # check if address is in database
             # this is safe to do because the address is validated above, but we strip some chars here too just in case
             address = address.replace('\'', '').replace(';', '').replace('"', '').replace('\\', '')
-            for i in c.execute("SELECT * FROM adders where address = ?;", (address,)):
+            for i in c.execute("SELECT * FROM adders WHERE address = ?;", (address,)):
                 try:
                     if i[0] == address:
                         conn.close()
@@ -428,13 +428,13 @@ class Core:
             return
 
         if randomOrder:
-            payload = 'SELECT * FROM peers where trust >= %s ORDER BY RANDOM();' % (trust,)
+            payload = 'SELECT * FROM peers WHERE trust >= ? ORDER BY RANDOM();'
         else:
-            payload = 'SELECT * FROM peers where trust >= %s;' % (trust,)
+            payload = 'SELECT * FROM peers WHERE trust >= ?;'
 
         peerList = []
 
-        for i in c.execute(payload):
+        for i in c.execute(payload, (trust,)):
             try:
                 if len(i[0]) != 0:
                     if getPow:
@@ -480,7 +480,7 @@ class Core:
         iterCount = 0
         retVal = ''
 
-        for row in c.execute('SELECT * from peers where id=?;', command):
+        for row in c.execute('SELECT * FROM peers WHERE id=?;', command):
             for i in row:
                 if iterCount == info:
                     retVal = i
@@ -631,10 +631,10 @@ class Core:
         c = conn.cursor()
         date = int(self._utils.getEpoch())
 
-        execute = 'SELECT hash FROM hashes WHERE expire <= %s ORDER BY dateReceived;' % (date,)
+        execute = 'SELECT hash FROM hashes WHERE expire <= ? ORDER BY dateReceived;'
 
         rows = list()
-        for row in c.execute(execute):
+        for row in c.execute(execute, (date,)):
             for i in row:
                 rows.append(i)
         return rows

onionr/onionrblacklist.py

@@ -34,15 +34,15 @@ class OnionrBlackList:
             raise Exception("Hashed data is not alpha numeric")
         if len(hashed) > 64:
             raise Exception("Hashed data is too large")
-        for i in self._dbExecute("select * from blacklist where hash='%s'" % (hashed,)):
+        for i in self._dbExecute("SELECT * FROM blacklist WHERE hash = ?", (hashed,)):
             retData = True # this only executes if an entry is present by that hash
             break
         return retData
 
-    def _dbExecute(self, toExec):
+    def _dbExecute(self, toExec, params = ()):
         conn = sqlite3.connect(self.blacklistDB)
         c = conn.cursor()
-        retData = c.execute(toExec)
+        retData = c.execute(toExec, params)
         conn.commit()
         return retData
 
@@ -60,13 +60,13 @@ class OnionrBlackList:
         except AttributeError:
             raise TypeError("dataType must be int")
 
-        for i in self._dbExecute('select * from blacklist where dataType=%s' % (dataType,)):
+        for i in self._dbExecute('SELECT * FROM blacklist WHERE dataType = ?', (dataType,)):
             if i[1] == dataType:
                 if (curTime - i[2]) >= i[3]:
                     deleteList.append(i[0])
 
         for thing in deleteList:
-            self._dbExecute("delete from blacklist where hash='%s'" % (thing,))
+            self._dbExecute("DELETE FROM blacklist WHERE hash = ?", (thing,))
 
     def generateDB(self):
         self._dbExecute('''CREATE TABLE blacklist(
@@ -79,10 +79,10 @@ class OnionrBlackList:
         return
 
     def clearDB(self):
-        self._dbExecute('''delete from blacklist;);''')
+        self._dbExecute('''DELETE FROM blacklist;);''')
 
     def getList(self):
-        data = self._dbExecute('select * from blacklist')
+        data = self._dbExecute('SELECT * FROM blacklist')
         myList = []
         for i in data:
             myList.append(i[0])
@@ -113,4 +113,4 @@ class OnionrBlackList:
             return
         insert = (hashed,)
         blacklistDate = self._core._utils.getEpoch()
-        self._dbExecute("insert into blacklist (hash, dataType, blacklistDate, expire) VALUES('%s', %s, %s, %s);" % (hashed, dataType, blacklistDate, expire))
+        self._dbExecute("INSERT INTO blacklist (hash, dataType, blacklistDate, expire) VALUES(?, ?, ?, ?);", (str(hashed), dataType, blacklistDate, expire))

onionr/onionrdaemontools.py

@@ -87,7 +87,7 @@ class DaemonTools:
         c = conn.cursor()
         time = self.daemon._core._utils.getEpoch()
         deleteKeys = []
-        for entry in c.execute("SELECT * FROM forwardKeys where expire <= ?", (time,)):
+        for entry in c.execute("SELECT * FROM forwardKeys WHERE expire <= ?", (time,)):
             logger.info(entry[1])
             deleteKeys.append(entry[1])
 

onionr/onionrusers.py

@@ -101,7 +101,7 @@ class OnionrUser:
         conn = sqlite3.connect(self._core.peerDB, timeout=10)
         c = conn.cursor()
 
-        for row in c.execute("SELECT forwardKey FROM forwardKeys WHERE peerKey = ? order by date desc", (self.publicKey,)):
+        for row in c.execute("SELECT forwardKey FROM forwardKeys WHERE peerKey = ? ORDER BY date DESC", (self.publicKey,)):
             key = row[0]
             break
 
@@ -113,7 +113,7 @@ class OnionrUser:
         conn = sqlite3.connect(self._core.peerDB, timeout=10)
         c = conn.cursor()
         keyList = []
-        for row in c.execute("SELECT forwardKey FROM forwardKeys WHERE peerKey = ? order by date desc", (self.publicKey,)):
+        for row in c.execute("SELECT forwardKey FROM forwardKeys WHERE peerKey = ? ORDER BY date DESC", (self.publicKey,)):
             key = row[0]
             keyList.append(key)
 
@@ -150,7 +150,7 @@ class OnionrUser:
         pubkey = self._core._utils.bytesToStr(pubkey)
         command = (pubkey,)
         keyList = [] # list of tuples containing pub, private for peer
-        for result in c.execute("SELECT * FROM myForwardKeys where peer=?", command):
+        for result in c.execute("SELECT * FROM myForwardKeys WHERE peer=?", command):
             keyList.append((result[1], result[2]))
         if len(keyList) == 0:
             if genNew:

onionr/onionrutils.py

@@ -328,7 +328,7 @@ class OnionrUtils:
         c = conn.cursor()
         if not self.validateHash(hash):
             raise Exception("Invalid hash")
-        for result in c.execute("SELECT COUNT() FROM hashes where hash='" + hash + "'"):
+        for result in c.execute("SELECT COUNT() FROM hashes WHERE hash = ?", (hash,)):
             if result[0] >= 1:
                 conn.commit()
                 conn.close()
@@ -510,7 +510,7 @@ class OnionrUtils:
         c = conn.cursor()
         command = (hash,)
         retData = ''
-        for row in c.execute('SELECT ID FROM peers where hashID=?', command):
+        for row in c.execute('SELECT id FROM peers WHERE hashID = ?', command):
             if row[0] != '':
                 retData = row[0]
         return retData