jim/URLNotesGrabberCore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: parameterize AddPost fallback UPDATE, guard args indexing

Browse Source 
Posts.hasImage/DateModified fallback update built its WHERE clause via
raw string concatenation of blogName/postID, unlike every other query
in this method — a blog name containing a single quote would break or
inject into the query. Switch it to parameters.

--parse, --blogsO, and --bop indexed args[1..3] before checking
args.Length, so a missing argument threw IndexOutOfRangeException
instead of hitting the intended usage message.
This commit is contained in:
jim
2026-06-30 20:41:51 -05:00
parent 4df73367fb
commit 0ff80a0fd3
2 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
URLNotesGrabberCORE/DataAccess.cs
+6 -2
View File
@@ -518,8 +518,12 @@ namespace URLNotesGrabberCORE
{ {
if (ownsConnection) connection.Open(); if (ownsConnection) connection.Open();
string updateSql = "UPDATE Posts SET hasImage = " + (hasImage ? 1 : 0) + ", DateModified = '" + DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss") + "' WHERE blogName = '" + blogName + "' AND postID = '" + postID + "'"; string updateSql = "UPDATE Posts SET hasImage = @hasImage, DateModified = @DateModified WHERE blogName = @blogName AND postID = @postID";
SQLiteCommand updateCommand = new SQLiteCommand(updateSql, connection); using SQLiteCommand updateCommand = new SQLiteCommand(updateSql, connection);
updateCommand.Parameters.AddWithValue("@hasImage", hasImage ? 1 : 0);
updateCommand.Parameters.AddWithValue("@DateModified", DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss"));
updateCommand.Parameters.AddWithValue("@blogName", blogName);
updateCommand.Parameters.AddWithValue("@postID", postID);
updateCommand.ExecuteNonQuery(); updateCommand.ExecuteNonQuery();
} }
URLNotesGrabberCORE/Program.cs
+10 -2
View File
@@ -175,6 +175,12 @@ namespace URLNotesGrabberCORE
break; break;
case "--parse": case "--parse":
if (args.Length < 2)
{
Console.WriteLine("Usage: --parse <blogname>");
exitCode = 2;
break;
}
string blogNameToParse = args[1]; string blogNameToParse = args[1];
int postsAdded = 0; int postsAdded = 0;
try try
@@ -283,7 +289,7 @@ namespace URLNotesGrabberCORE
case "--blogsO": //collect notes from all posts case "--blogsO": //collect notes from all posts
int from = 1, to = 999999, top = 100; int from = 1, to = 999999, top = 100;
if (args[1] is not null && args[2] is not null && args[3] is not null) if (args.Length >= 4 && args[1] is not null && args[2] is not null && args[3] is not null)
{ {
from = int.Parse(args[1]); from = int.Parse(args[1]);
to = int.Parse(args[2]); to = int.Parse(args[2]);
@@ -293,6 +299,7 @@ namespace URLNotesGrabberCORE
{ {
Console.WriteLine("--Expected FROM TO--"); Console.WriteLine("--Expected FROM TO--");
exitCode = 2; exitCode = 2;
break;
} }
WriteBlogsToFile(settings.GetValue<string>("PathOutputBlogs"), false, from, to, top); WriteBlogsToFile(settings.GetValue<string>("PathOutputBlogs"), false, from, to, top);
break; break;
@@ -300,7 +307,7 @@ namespace URLNotesGrabberCORE
case "--bop": //collect notes from all posts case "--bop": //collect notes from all posts
from = 1; to = 999999; top = 100; from = 1; to = 999999; top = 100;
if (args[1] is not null && args[2] is not null && args[3] is not null) if (args.Length >= 4 && args[1] is not null && args[2] is not null && args[3] is not null)
{ {
from = int.Parse(args[1]); from = int.Parse(args[1]);
to = int.Parse(args[2]); to = int.Parse(args[2]);
@@ -310,6 +317,7 @@ namespace URLNotesGrabberCORE
{ {
Console.WriteLine("--Expected FROM TO--"); Console.WriteLine("--Expected FROM TO--");
exitCode = 2; exitCode = 2;
break;
} }
WriteBlogsToFileAll(settings.GetValue<string>("PathOutputBlogs"), false, from, to, top); WriteBlogsToFileAll(settings.GetValue<string>("PathOutputBlogs"), false, from, to, top);
break; break;