ryzendigo aea91a91d5 fix: use parameterized query in get_face_ids to prevent SQL injection (#22500) ...

The name parameter was interpolated directly into the SQL query via
f-string, allowing SQL injection through crafted face name values.

Use a parameterized query with ? placeholder instead.

2026-03-16 17:23:44 -06:00

11 KiB

Raw Permalink Blame History

View Raw