One View Per Layer: Four Sharp Edges I Found in My Own Code
There is a layer in my database called 1 . Somebody created it, presumably by accident, and it sat there for months looking harmless. It was the only layer in the system that never served a single tile, and nobody noticed, because it was empty anyway. That layer turned out to be a symptom of a SQL injection vulnerability. This post is about the design that produced it — which I still think is a…
The report covers a SQL injection vulnerability discovered in a web GIS system with a large number of features. The system had a design flaw where layers were created dynamically using user-provided input, without proper validation. This led to the creation of an empty layer named "1" which, when saved, resulted in a SQL injection vulnerability.
The vulnerability was discovered because the view for this layer caused a syntax error since the name started with a digit. The author adopted psycopg2.sql to safely handle user-supplied strings and prevent SQL injection attacks. They also realized that case sensitivity in PostgreSQL identifiers could lead to duplicate views for the same layer, if not handled correctly.
The issue was fixed by normalizing layer names to lowercase, ensuring consistent view names, and avoiding potential name collisions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
