Uploaded image for project: 'Satellite'
  1. Satellite
  2. SAT-28204

Fix for Invalid SQL Query Error Caused by Special Characters in Red Hat Satellite Search

XMLWordPrintable

    • Low
    • None

      Description:
      A potential issue has been identified in the Red Hat Satellite tool where entering certain special characters (such as $ or &%) in the "Search Hosts" tab results in database-specific errors. While this is not a SQL injection vulnerability (as confirmed by our security architects), the presence of these characters renders an invalid SQL query. The input is correctly sanitized, but the error still affects user experience.

      Steps to Reproduce:

      Go to the "Search Hosts" tab in the Red Hat Satellite tool.
      Enter special characters such as $ or &% in the search input.
      Observe the resulting database-specific error.

      Expected Outcome:
      The search input should handle special characters gracefully without causing an invalid SQL query or error messages.

      Actual Outcome:
      The search input results in database-specific errors when special characters are entered.

      Additional Notes:
      The security team has confirmed that this is not a SQL injection but an issue related to query handling for special characters. Please review and implement a fix to ensure the tool behaves correctly in these scenarios.

              aruzicka@redhat.com Adam Ruzicka
              rh-ee-abhraj Abhishek Raj
              Oleh Fedorenko Oleh Fedorenko
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: