From 0ff80a0fd3de8583db087aa47fe031cc78a8183a Mon Sep 17 00:00:00 2001
From: jim <bassofeesh@gmail.com>
Date: Tue, 30 Jun 2026 20:41:51 -0500
Subject: [PATCH] fix: parameterize AddPost fallback UPDATE, guard args
 indexing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Posts.hasImage/DateModified fallback update built its WHERE clause via
raw string concatenation of blogName/postID, unlike every other query
in this method — a blog name containing a single quote would break or
inject into the query. Switch it to parameters.

--parse, --blogsO, and --bop indexed args[1..3] before checking
args.Length, so a missing argument threw IndexOutOfRangeException
instead of hitting the intended usage message.
---
 URLNotesGrabberCORE/DataAccess.cs |  8 ++++++--
 URLNotesGrabberCORE/Program.cs    | 12 ++++++++++--
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/URLNotesGrabberCORE/DataAccess.cs b/URLNotesGrabberCORE/DataAccess.cs
index 99e9490..c54d461 100644
--- a/URLNotesGrabberCORE/DataAccess.cs
+++ b/URLNotesGrabberCORE/DataAccess.cs
@@ -518,8 +518,12 @@ namespace URLNotesGrabberCORE
                         {
                             if (ownsConnection) connection.Open();
 
-                            string updateSql = "UPDATE Posts SET hasImage = " + (hasImage ? 1 : 0) + ", DateModified = '" + DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss") + "' WHERE blogName = '" + blogName + "' AND postID = '" + postID + "'";
-                            SQLiteCommand updateCommand = new SQLiteCommand(updateSql, connection);
+                            string updateSql = "UPDATE Posts SET hasImage = @hasImage, DateModified = @DateModified WHERE blogName = @blogName AND postID = @postID";
+                            using SQLiteCommand updateCommand = new SQLiteCommand(updateSql, connection);
+                            updateCommand.Parameters.AddWithValue("@hasImage", hasImage ? 1 : 0);
+                            updateCommand.Parameters.AddWithValue("@DateModified", DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss"));
+                            updateCommand.Parameters.AddWithValue("@blogName", blogName);
+                            updateCommand.Parameters.AddWithValue("@postID", postID);
 
                             updateCommand.ExecuteNonQuery();
                         }
diff --git a/URLNotesGrabberCORE/Program.cs b/URLNotesGrabberCORE/Program.cs
index 1604dd8..4fe250d 100644
--- a/URLNotesGrabberCORE/Program.cs
+++ b/URLNotesGrabberCORE/Program.cs
@@ -175,6 +175,12 @@ namespace URLNotesGrabberCORE
                         break;
 
                     case "--parse":
+                        if (args.Length < 2)
+                        {
+                            Console.WriteLine("Usage: --parse <blogname>");
+                            exitCode = 2;
+                            break;
+                        }
                         string blogNameToParse = args[1];
                         int postsAdded = 0;
                         try
@@ -283,7 +289,7 @@ namespace URLNotesGrabberCORE
                     case "--blogsO": //collect notes from all posts
                         int from = 1, to = 999999, top = 100;
 
-                        if (args[1] is not null && args[2] is not null && args[3] is not null)
+                        if (args.Length >= 4 && args[1] is not null && args[2] is not null && args[3] is not null)
                         {
                             from = int.Parse(args[1]);
                             to = int.Parse(args[2]);
@@ -293,6 +299,7 @@ namespace URLNotesGrabberCORE
                         {
                             Console.WriteLine("--Expected FROM TO--");
                             exitCode = 2;
+                            break;
                         }
                         WriteBlogsToFile(settings.GetValue<string>("PathOutputBlogs"), false, from, to, top);
                         break;
@@ -300,7 +307,7 @@ namespace URLNotesGrabberCORE
                     case "--bop": //collect notes from all posts
                         from = 1; to = 999999; top = 100;
 
-                        if (args[1] is not null && args[2] is not null && args[3] is not null)
+                        if (args.Length >= 4 && args[1] is not null && args[2] is not null && args[3] is not null)
                         {
                             from = int.Parse(args[1]);
                             to = int.Parse(args[2]);
@@ -310,6 +317,7 @@ namespace URLNotesGrabberCORE
                         {
                             Console.WriteLine("--Expected FROM TO--");
                             exitCode = 2;
+                            break;
                         }
                         WriteBlogsToFileAll(settings.GetValue<string>("PathOutputBlogs"), false, from, to, top);
                         break;