fix(security): close backend merge blockers

2026-08-18 17:51:29 +08:00
parent 2581631b51
commit 8853877fcd
15 changed files with 216 additions and 50 deletions
@@ -23,7 +23,11 @@ def from_postgis_point(coord: str) -> dict[str, float]:


 def get_node_coord(name: str, node: str) -> dict[str, float]:
-    row = try_read(name, f"select st_astext(coord) as coord_geom from coordinates where node = '{node}'")
+    row = try_read(
+        name,
+        "select st_astext(coord) as coord_geom from coordinates where node = %s",
+        (node,),
+    )
    if row == None:
        write(name, sql_insert_coord(node, 0.0, 0.0))
        return {'x': 0.0, 'y': 0.0}
@@ -66,7 +70,9 @@ def get_links_in_extent(name: str, x1: float, y1: float, x2: float, y2: float) -


 def node_has_coord(name: str, node: str) -> bool:
-    return try_read(name, f"select node from coordinates where node = '{node}'") != None
+    return try_read(
+        name, "select node from coordinates where node = %s", (node,)
+    ) != None


 #--------------------------------------------------------------