Initial project setup with core functionality for exporting Unity memory snapshots to DuckDB or SQLite and generating HTML reports.#1
Conversation
…ory snapshots to DuckDB or SQLite and generating HTML reports. Added CLI interface, project structure, and build scripts. Included .gitignore and CI configuration for automated testing.
![cycode-security[bot]](https://avatars.githubusercontent.com/in/39308?s=60&v=4){kind=small}
| { | ||
| using var command = connection.CreateCommand(); | ||
| command.Transaction = tx; | ||
| command.CommandText = sql; |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized external input in SQL query'.
Severity: Critical
Description
Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data.
Cycode Remediation Guideline
✅ Do
- Do validate all external input to ensure it meets the expected format before including it in SQL queries.
string order = sortingOrder == "DESC" ? "DESC" : "ASC";- Do use safe lists to validate external input, if dynamic input is required.
private static string ValidatedTableName(string tableName) {
if (ALLOWED_TABLE_NAMES.Contains(tableName)) {
return tableName;
} else {
// handle invalid table name
}
}- Do use parameterized database queries to separate SQL logic from external input, significantly reducing the risk of SQL injection.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = @username";
SqlCommand cmd = new SqlCommand(query, conn);
cmd.Parameters.AddWithValue("@username", unsafeInput);
// ...
}❌ Don't
- Do not include raw external input in SQL queries. This practice can lead to SQL injection vulnerabilities.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = '" + unsafeInput + "'";
SqlCommand cmd = new SqlCommand(query, conn);
// ...
}📋 References
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| { | ||
| using var command = connection.CreateCommand(); | ||
| command.Transaction = tx; | ||
| command.CommandText = sql; |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized external input in SQL query'.
Severity: Critical
Description
Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data.
Cycode Remediation Guideline
✅ Do
- Do validate all external input to ensure it meets the expected format before including it in SQL queries.
string order = sortingOrder == "DESC" ? "DESC" : "ASC";- Do use safe lists to validate external input, if dynamic input is required.
private static string ValidatedTableName(string tableName) {
if (ALLOWED_TABLE_NAMES.Contains(tableName)) {
return tableName;
} else {
// handle invalid table name
}
}- Do use parameterized database queries to separate SQL logic from external input, significantly reducing the risk of SQL injection.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = @username";
SqlCommand cmd = new SqlCommand(query, conn);
cmd.Parameters.AddWithValue("@username", unsafeInput);
// ...
}❌ Don't
- Do not include raw external input in SQL queries. This practice can lead to SQL injection vulnerabilities.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = '" + unsafeInput + "'";
SqlCommand cmd = new SqlCommand(query, conn);
// ...
}📋 References
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| public (string[] Columns, List<object?[]> Rows) ExecuteQuery(string sql) | ||
| { | ||
| using var cmd = _connection.CreateCommand(); | ||
| cmd.CommandText = sql; |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized external input in SQL query'.
Severity: Critical
Description
Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data.
Cycode Remediation Guideline
✅ Do
- Do validate all external input to ensure it meets the expected format before including it in SQL queries.
string order = sortingOrder == "DESC" ? "DESC" : "ASC";- Do use safe lists to validate external input, if dynamic input is required.
private static string ValidatedTableName(string tableName) {
if (ALLOWED_TABLE_NAMES.Contains(tableName)) {
return tableName;
} else {
// handle invalid table name
}
}- Do use parameterized database queries to separate SQL logic from external input, significantly reducing the risk of SQL injection.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = @username";
SqlCommand cmd = new SqlCommand(query, conn);
cmd.Parameters.AddWithValue("@username", unsafeInput);
// ...
}❌ Don't
- Do not include raw external input in SQL queries. This practice can lead to SQL injection vulnerabilities.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = '" + unsafeInput + "'";
SqlCommand cmd = new SqlCommand(query, conn);
// ...
}📋 References
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| private static long QueryCount(SqliteConnection connection, string sql) | ||
| { | ||
| using var cmd = connection.CreateCommand(); | ||
| cmd.CommandText = sql; |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized external input in SQL query'.
Severity: Critical
Description
Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data.
Cycode Remediation Guideline
✅ Do
- Do validate all external input to ensure it meets the expected format before including it in SQL queries.
string order = sortingOrder == "DESC" ? "DESC" : "ASC";- Do use safe lists to validate external input, if dynamic input is required.
private static string ValidatedTableName(string tableName) {
if (ALLOWED_TABLE_NAMES.Contains(tableName)) {
return tableName;
} else {
// handle invalid table name
}
}- Do use parameterized database queries to separate SQL logic from external input, significantly reducing the risk of SQL injection.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = @username";
SqlCommand cmd = new SqlCommand(query, conn);
cmd.Parameters.AddWithValue("@username", unsafeInput);
// ...
}❌ Don't
- Do not include raw external input in SQL queries. This practice can lead to SQL injection vulnerabilities.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = '" + unsafeInput + "'";
SqlCommand cmd = new SqlCommand(query, conn);
// ...
}📋 References
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| sql.Append(')'); | ||
| } | ||
|
|
||
| command.CommandText = sql.ToString(); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized external input in SQL query'.
Severity: Critical
Description
Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data.
Cycode Remediation Guideline
✅ Do
- Do validate all external input to ensure it meets the expected format before including it in SQL queries.
string order = sortingOrder == "DESC" ? "DESC" : "ASC";- Do use safe lists to validate external input, if dynamic input is required.
private static string ValidatedTableName(string tableName) {
if (ALLOWED_TABLE_NAMES.Contains(tableName)) {
return tableName;
} else {
// handle invalid table name
}
}- Do use parameterized database queries to separate SQL logic from external input, significantly reducing the risk of SQL injection.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = @username";
SqlCommand cmd = new SqlCommand(query, conn);
cmd.Parameters.AddWithValue("@username", unsafeInput);
// ...
}❌ Don't
- Do not include raw external input in SQL queries. This practice can lead to SQL injection vulnerabilities.
using (SqlConnection conn = new SqlConnection(connection_string))
{
string query = "SELECT * FROM Users WHERE Username = '" + unsafeInput + "'";
SqlCommand cmd = new SqlCommand(query, conn);
// ...
}📋 References
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
1 participant
Initial project setup with core functionality for exporting Unity memory snapshots to DuckDB or SQLite and generating HTML reports. Added CLI interface, project structure, and build scripts. Included .gitignore and CI configuration for automated testing.