[samialfattani]

A run-time error is raised when get_one() is called in flask_admin.contrib.sqla.view.ModelView

To replicate the error try to browse this: /admin/details/?id=1,2

Risk:
A security vulnerability is raised by Tnable where it could lead to Blind SQL Inejection which is classified as a High risk vulnerability. This can be exploited in /edit and /details

A test case is added to make sure that /admin/details/?id=1,2 is working as expected

[ElLorans]

The value is passed to SQLAlchemy’s Session.get() using bound parameters, not interpolated SQL, so the security vulnerability is a false positive.
Passing 1,2 on a model with int primary key returns a 400 response, which is correct, so I am inclined towards closing this PR.

[samialfattani]

The value is passed to SQLAlchemy’s Session.get() using bound parameters, not interpolated SQL, so the security vulnerability is a false positive. Passing 1,2 on a model with int primary key returns a 400 response, which is correct, so I am inclined towards closing this PR.

Actually it returns 500!, here is what we got without this PR

[hasansezertasan]

Actually it returns 500!, here is what we got without this PR

Can you provide a MRE please?

[samialfattani]

Fixes #2915

[samialfattani]

Can you provide a MRE please?

here it is

from flask import Flask
import sqlalchemy as sa

from flask_sqlalchemy import SQLAlchemy
from sqlalchemy.orm import Mapped
from sqlalchemy.orm import mapped_column
from flask_admin.contrib.sqla import ModelView
from flask_admin import Admin, expose
from flask_babel import Babel


app = Flask(__name__)
app.config["SECRET_KEY"] = "secret"
app.config["SQLALCHEMY_DATABASE_URI"] = "sqlite:///" 
app.config["SQLALCHEMY_ECHO"] = False
app.config["SQLALCHEMY_TRACK_MODIFICATIONS"] = False

db = SQLAlchemy(app)

@app.route("/")
def index():
    return "<a href='/admin/'>Click me to get to Admin!</a>"


class User(db.Model):
    id: Mapped[int] = mapped_column(sa.Integer, primary_key=True, autoincrement=True)
    fullname: Mapped[str] = mapped_column(sa.String(64))
    status: Mapped[str] = mapped_column(sa.UnicodeText)

class UserModelView(ModelView):
    can_view_details = True


babel = Babel(app, locale_selector=lambda: "en")

admin = Admin(app, name="Example: SQLAlchemy")

admin.add_view(UserModelView(User, db))

if __name__ == "__main__":

    with app.app_context():
        db.drop_all()
        db.create_all()            
        user1 = User(id=1, fullname="John Doe", status="trialing")
        user2 = User(id=2, fullname="Jane Smith", status="active")
        db.session.add_all([user1, user2])
        db.session.commit()

    app.run(debug=True)

to replicate the error:
http://127.0.0.1:5000/admin/user/details/?id=1,2