app.py : 12 · get_user()
High · CWE-89 SQL Injection
12− record = cur.execute(f"SELECT id, name FROM users WHERE id = {user_id}").fetchone()13− conn.close()12+ row = cur.execute("SELECT id, name FROM users WHERE id = %s", (user_id,)).fetchone()13 if record is None:14 return jsonify({"error": "not found"}), 40415 return jsonify({"id": record[0], "name": record[1]})
The model parameterised the query, but it also renamed the variable, used a placeholder sqlite3 doesn't support, and dropped conn.close(). All three changes are highlighted.
- IDENTIFIER RESTORED
rowsits whererecordwas, and lines 13–15 still readrecord. The patch is rewritten to use the original name. - SQL_PLACEHOLDER_MISMATCH
This file imports
sqlite3, which accepts?, not%s. This would fail on the first request. - STATEMENT_REMOVED
conn.close()has nothing to do with the injection. Reproduce every line of the target. - REPAIR ROUND 1
The exact failure reasons go back to the model, and the corrected candidate passes all eleven checks.
12− record = cur.execute(f"SELECT id, name FROM users WHERE id = {user_id}").fetchone()12+ record = cur.execute("SELECT id, name FROM users WHERE id = ?", (user_id,)).fetchone()13 conn.close()14 if record is None:15 return jsonify({"error": "not found"}), 40416 return jsonify({"id": record[0], "name": record[1]})
One line changed. The variable keeps its name, the placeholder matches the driver, and the file still compiles.
11 / 11 checks passed · merged into the full file