ScalaSQL: startsWith, endsWith and contains treat % and _ in user values as wildcards
Confirmed · medium · Wrong-result bug
The LIKE pattern concatenates the value and does not escape it. A search for 50% matches any string that starts with 50, and a_b matches axb, so untrusted input widens the match.
Found: ; reported: ; status since: . Reporter: Mike Murunov
Page for this report · Public report
Proposed fix sounds good to me. Thanks in advance for submitting a PR!