Description
ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| chirpstack | chirpstack | ≤ 4.19.0-test.5 | — |
References
- https://github.com/chirpstack/chirpstack third-party-advisory
- https://github.com/chirpstack/chirpstack/blob/master/chirpstack/src/storage/device.rs third-party-advisory