LiteJQ: Jq Support in SQLite (opens in new tab)

(github.com)

11 pointsjeroenjanssens2y ago2 comments

2 comments

Thanks, this is really helpful!

Is there any way to write "malicious" jq code (endless loops, IO, …)?

Any input passed to jq(text,text) is directly passed through to jq's internal compiler, so it's a job left for that.

Now, can jq be used for SQL injection in an SQLite context? That's interesting in theory, but I'd assume any decent driver would validate its input as data and not code.

j / k navigate · click thread line to collapse

2 comments

adius2y ago

Thanks, this is really helpful!

Is there any way to write "malicious" jq code (endless loops, IO, …)?

fforflo2y ago

Any input passed to jq(text,text) is directly passed through to jq's internal compiler, so it's a job left for that.

Now, can jq be used for SQL injection in an SQLite context? That's interesting in theory, but I'd assume any decent driver would validate its input as data and not code.

j / k navigate · click thread line to collapse