rikkraan / kubernetes-flask-mysql Goto Github PK

There are multiple instances of possible SQL injection in the Flask application.

Example: https://github.com/RikKraanVantage/kubernetes-flask-mysql/blob/5fc79c15accf28bd47c5bc0bbd2170a16e42bbcd/flaskapi.py#L33

As per OWASP, you should not construct queries as strings and use parametrized queries instead: https://owasp.org/www-community/attacks/SQL_Injection

Example on how to use parametrized queries with Flask-MySQL: https://stackoverflow.com/questions/41651823/flask-mysql-how-to-effectively-insert-into-table-with-parameterized-queries

Hello,
by using minikube service flask-service,
I get the followin

g
while the url opens in my browser, it won't connect.
Can you help me?

In flaskapp-deployment.yml you are not configuring this environ variables MYSQL_SERVICE_HOST and MYSQL_SERVICE_PORT

And in the code you are using it

# MySQL configurations
app.config["MYSQL_DATABASE_USER"] = "root"
app.config["MYSQL_DATABASE_PASSWORD"] = os.getenv("db_root_password")
app.config["MYSQL_DATABASE_DB"] = os.getenv("db_name")
app.config["MYSQL_DATABASE_HOST"] = os.getenv("MYSQL_SERVICE_HOST")
app.config["MYSQL_DATABASE_PORT"] = int(os.getenv("MYSQL_SERVICE_PORT"))
mysql.init_app(app)

Hello,
When I use curl create user it will output Http Status 400

Can you help me?
Thanks!