Question

I am having users both create and connect to a database through a python application,

           dbname = raw_input("Please enter the game name you wish to connect to, or the name of a new game: ")
           db = sqlite3.connect(dbname)

I’m curious: is there any kind of input a potentially malicious user could use to attack the database (providing I have no other vulnerabilities in the other handlers), or to attack the underlying system running python? (I am aware that a user could continue to create an infinite number of databases by running the program over and over, however I can’t think of any other solution than quotas for that).

Thanks in advance!

Travis

Answer 1

They can pass in ":memory", which may or may not have an adverse effect on the system, depending on what your application does.

They can control transactions (via the isolation_level parameter), which might mess up your program’s interaction with the database.

I would check user-input against a dictionary of possible database names.