Fix possible SQL injection

arrowtail-precision · Dec 15, 2023 · 0c98f55 · 0c98f55
1 parent ff64b44
commit 0c98f55
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/querybook/server/app/auth/auth0_auth.py b/querybook/server/app/auth/auth0_auth.py
@@ -115,9 +115,8 @@ def _parse_user_profile(self, resp):
 
     @with_session
     def login_user(self, username, email, fullname, session=None):
-        if not username:
-            raise AuthenticationError("Username must not be empty!")
-
+        if not username or not isinstance(username, str):
+            raise AuthenticationError("Please provide a valid username")
         user = get_user_by_name(username, session=session)
         if not user:
             user = create_user(