Read-only demo. These reviews were made by a local model (qwen3:8b) on a laptop GPU, then copied here; nothing runs on this server but the pages. Source and evaluation: github.com/RAIF-KARANI/codelens. To run it on your own repositories, download CodeLens Desktop for Windows.
Go to a repository or a review, or switch the theme.
Review #1384PR #1 on GitHub ↗1185681…c4c38eeqwen3:8btook 15 s
1 critical
| @@ −2511 +2511 @@ class Table(Queryable): | |||
| 2511 | 2511 | Trigger(*r) | |
| 2512 | 2512 | for r in self.db.execute( | |
| 2513 | 2513 | "select name, tbl_name, sql from sqlite_master where type = 'trigger'" | |
| 2514 | − | " and tbl_name = ?", | |
| 2515 | − | (self.name,), | |
| 2514 | + | f" and tbl_name = '{self.name}'", | |
Potential SQL injection vulnerabilitysqlite_utils/db.py:2514The code directly interpolates the `self.name` into the SQL query string, which can lead to SQL injection if `self.name` is not properly sanitized. This could allow an attacker to execute arbitrary SQL code. | |||
| 2516 | 2515 | ).fetchall() | |
| 2517 | 2516 | ] | |
| 2518 | 2517 | ||