From 10164db2586685f1564f205627f7c511dd7b04df Mon Sep 17 00:00:00 2001 From: LimaniBhavik <6619586+LimaniBhavik@users.noreply.github.com> Date: Mon, 18 May 2026 12:24:37 +0000 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=94=92=20fix:=20Eliminate=20SQL=20inj?= =?UTF-8?q?ection=20vulnerability=20in=20database=20creation?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Replace dynamic string interpolation with static hardcoded SQL in `_createDb` - Change class schema variables (table/columns names) to `static const String` - Add `TEXT` data type to the `thumbnail` column - Fix null safety static issues with `DatabaseHelper` singleton variables --- example/pubspec.lock | 252 +++++++++++++++++++++++++++++++++- lib/Utils/DatabaseHelper.dart | 71 ++++++---- pubspec.yaml | 2 + 3 files changed, 296 insertions(+), 29 deletions(-) diff --git a/example/pubspec.lock b/example/pubspec.lock index a9fd211..b92ee55 100644 --- a/example/pubspec.lock +++ b/example/pubspec.lock @@ -1,6 +1,14 @@ # Generated by pub # See https://dart.dev/tools/pub/glossary#lockfile packages: + args: + dependency: transitive + description: + name: args + sha256: d0481093c50b1da8910eb0bb301626d4d8eb7284aa739614d2b394ee09e3ea04 + url: "https://pub.dev" + source: hosted + version: "2.7.0" async: dependency: transitive description: @@ -33,6 +41,14 @@ packages: url: "https://pub.dev" source: hosted version: "1.1.2" + code_assets: + dependency: transitive + description: + name: code_assets + sha256: "83ccdaa064c980b5596c35dd64a8d3ecc68620174ab9b90b6343b753aa721687" + url: "https://pub.dev" + source: hosted + version: "1.0.0" collection: dependency: transitive description: @@ -41,6 +57,14 @@ packages: url: "https://pub.dev" source: hosted version: "1.19.1" + crypto: + dependency: transitive + description: + name: crypto + sha256: c8ea0233063ba03258fbcf2ca4d6dadfefe14f02fab57702265467a19f27fadf + url: "https://pub.dev" + source: hosted + version: "3.0.7" fake_async: dependency: transitive description: @@ -49,6 +73,22 @@ packages: url: "https://pub.dev" source: hosted version: "1.3.3" + ffi: + dependency: transitive + description: + name: ffi + sha256: "6d7fd89431262d8f3125e81b50d3847a091d846eafcd4fdb88dd06f36d705a45" + url: "https://pub.dev" + source: hosted + version: "2.2.0" + file: + dependency: transitive + description: + name: file + sha256: a3b4f84adafef897088c160faf7dfffb7696046cb13ae90b508c2cbc95d3b8d4 + url: "https://pub.dev" + source: hosted + version: "7.0.1" flutter: dependency: "direct main" description: flutter @@ -64,6 +104,38 @@ packages: description: flutter source: sdk version: "0.0.0" + glob: + dependency: transitive + description: + name: glob + sha256: c3f1ee72c96f8f78935e18aa8cecced9ab132419e8625dc187e1c2408efc20de + url: "https://pub.dev" + source: hosted + version: "2.1.3" + hooks: + dependency: transitive + description: + name: hooks + sha256: "025f060e86d2d4c3c47b56e33caf7f93bf9283340f26d23424ebcfccf34f621e" + url: "https://pub.dev" + source: hosted + version: "1.0.3" + jni: + dependency: transitive + description: + name: jni + sha256: c2230682d5bc2362c1c9e8d3c7f406d9cbba23ab3f2e203a025dd47e0fb2e68f + url: "https://pub.dev" + source: hosted + version: "1.0.0" + jni_flutter: + dependency: transitive + description: + name: jni_flutter + sha256: "8b59e590786050b1cd866677dddaf76b1ade5e7bc751abe04b86e84d379d3ba6" + url: "https://pub.dev" + source: hosted + version: "1.0.1" leak_tracker: dependency: transitive description: @@ -88,6 +160,14 @@ packages: url: "https://pub.dev" source: hosted version: "3.0.2" + logging: + dependency: transitive + description: + name: logging + sha256: c8245ada5f1717ed44271ed1c26b8ce85ca3228fd2ffdb75468ab01979309d61 + url: "https://pub.dev" + source: hosted + version: "1.3.0" matcher: dependency: transitive description: @@ -112,6 +192,30 @@ packages: url: "https://pub.dev" source: hosted version: "1.17.0" + native_toolchain_c: + dependency: transitive + description: + name: native_toolchain_c + sha256: "6ba77bb18063eebe9de401f5e6437e95e1438af0a87a3a39084fbd37c90df572" + url: "https://pub.dev" + source: hosted + version: "0.17.6" + objective_c: + dependency: transitive + description: + name: objective_c + sha256: "100a1c87616ab6ed41ec263b083c0ef3261ee6cd1dc3b0f35f8ddfa4f996fe52" + url: "https://pub.dev" + source: hosted + version: "9.3.0" + package_config: + dependency: transitive + description: + name: package_config + sha256: f096c55ebb7deb7e384101542bfba8c52696c1b56fca2eb62827989ef2353bbc + url: "https://pub.dev" + source: hosted + version: "2.2.0" path: dependency: transitive description: @@ -120,6 +224,62 @@ packages: url: "https://pub.dev" source: hosted version: "1.9.1" + path_provider: + dependency: transitive + description: + name: path_provider + sha256: "50c5dd5b6e1aaf6fb3a78b33f6aa3afca52bf903a8a5298f53101fdaee55bbcd" + url: "https://pub.dev" + source: hosted + version: "2.1.5" + path_provider_android: + dependency: transitive + description: + name: path_provider_android + sha256: "69cbd515a62b94d32a7944f086b2f82b4ac40a1d45bebfc00813a430ab2dabcd" + url: "https://pub.dev" + source: hosted + version: "2.3.1" + path_provider_foundation: + dependency: transitive + description: + name: path_provider_foundation + sha256: "2a376b7d6392d80cd3705782d2caa734ca4727776db0b6ec36ef3f1855197699" + url: "https://pub.dev" + source: hosted + version: "2.6.0" + path_provider_linux: + dependency: transitive + description: + name: path_provider_linux + sha256: f7a1fe3a634fe7734c8d3f2766ad746ae2a2884abe22e241a8b301bf5cac3279 + url: "https://pub.dev" + source: hosted + version: "2.2.1" + path_provider_platform_interface: + dependency: transitive + description: + name: path_provider_platform_interface + sha256: "88f5779f72ba699763fa3a3b06aa4bf6de76c8e5de842cf6f29e2e06476c2334" + url: "https://pub.dev" + source: hosted + version: "2.1.2" + path_provider_windows: + dependency: transitive + description: + name: path_provider_windows + sha256: bd6f00dbd873bfb70d0761682da2b3a2c2fccc2b9e84c495821639601d81afe7 + url: "https://pub.dev" + source: hosted + version: "2.3.0" + platform: + dependency: transitive + description: + name: platform + sha256: "5d6b1b0036a5f331ebc77c850ebc8506cbc1e9416c27e59b439f917a902a4984" + url: "https://pub.dev" + source: hosted + version: "3.1.6" plugin_platform_interface: dependency: transitive description: @@ -128,6 +288,22 @@ packages: url: "https://pub.dev" source: hosted version: "2.1.8" + pub_semver: + dependency: transitive + description: + name: pub_semver + sha256: "5bfcf68ca79ef689f8990d1160781b4bad40a3bd5e5218ad4076ddb7f4081585" + url: "https://pub.dev" + source: hosted + version: "2.2.0" + record_use: + dependency: transitive + description: + name: record_use + sha256: "2551bd8eecfe95d14ae75f6021ad0248be5c27f138c2ec12fcb52b500b3ba1ed" + url: "https://pub.dev" + source: hosted + version: "0.6.0" sky_engine: dependency: transitive description: flutter @@ -141,6 +317,46 @@ packages: url: "https://pub.dev" source: hosted version: "1.10.2" + sqflite: + dependency: transitive + description: + name: sqflite + sha256: "564cfed0746fe53140c23b70b308e045c3b31f17778f2f326ccb7d804ea0250a" + url: "https://pub.dev" + source: hosted + version: "2.4.2+1" + sqflite_android: + dependency: transitive + description: + name: sqflite_android + sha256: "881e28efdcc9950fd8e9bb42713dcf1103e62a2e7168f23c9338d82db13dec40" + url: "https://pub.dev" + source: hosted + version: "2.4.2+3" + sqflite_common: + dependency: transitive + description: + name: sqflite_common + sha256: "1581ffbf7a0e333b380d6a30737d78516b826cb35beb7fb0bf8a3ea0c678b465" + url: "https://pub.dev" + source: hosted + version: "2.5.8" + sqflite_darwin: + dependency: transitive + description: + name: sqflite_darwin + sha256: "279832e5cde3fe99e8571879498c9211f3ca6391b0d818df4e17d9fff5c6ccb3" + url: "https://pub.dev" + source: hosted + version: "2.4.2" + sqflite_platform_interface: + dependency: transitive + description: + name: sqflite_platform_interface + sha256: "8dd4515c7bdcae0a785b0062859336de775e8c65db81ae33dd5445f35be61920" + url: "https://pub.dev" + source: hosted + version: "2.4.0" stack_trace: dependency: transitive description: @@ -165,6 +381,14 @@ packages: url: "https://pub.dev" source: hosted version: "1.4.1" + synchronized: + dependency: transitive + description: + name: synchronized + sha256: "63896c27e81b28f8cb4e69ead0d3e8f03f1d1e5fc531a3e579cabed6a2c7c9e5" + url: "https://pub.dev" + source: hosted + version: "3.4.0+1" term_glyph: dependency: transitive description: @@ -181,6 +405,14 @@ packages: url: "https://pub.dev" source: hosted version: "0.7.9" + typed_data: + dependency: transitive + description: + name: typed_data + sha256: f9049c039ebfeb4cf7a7104a675823cd72dba8297f264b6637062516699fa006 + url: "https://pub.dev" + source: hosted + version: "1.4.0" vector_math: dependency: transitive description: @@ -204,6 +436,22 @@ packages: url: "https://pub.dev" source: hosted version: "15.2.0" + xdg_directories: + dependency: transitive + description: + name: xdg_directories + sha256: "7a3f37b05d989967cdddcbb571f1ea834867ae2faa29725fd085180e0883aa15" + url: "https://pub.dev" + source: hosted + version: "1.1.0" + yaml: + dependency: transitive + description: + name: yaml + sha256: b9da305ac7c39faa3f030eccd175340f968459dae4af175130b3fc47e40d76ce + url: "https://pub.dev" + source: hosted + version: "3.1.3" sdks: - dart: ">=3.9.0-0 <4.0.0" - flutter: ">=3.18.0-18.0.pre.54" + dart: ">=3.11.0 <4.0.0" + flutter: ">=3.38.4" diff --git a/lib/Utils/DatabaseHelper.dart b/lib/Utils/DatabaseHelper.dart index 3f0b340..1ca3fe2 100644 --- a/lib/Utils/DatabaseHelper.dart +++ b/lib/Utils/DatabaseHelper.dart @@ -5,19 +5,19 @@ import 'package:path_provider/path_provider.dart'; import '../Models/VideoModel.dart'; class DatabaseHelper { - static DatabaseHelper _databaseHelper; // Singleton DatabaseHelper - static Database _database; // Singleton Database - - String vidTable = 'vid_table'; - String colId = 'id'; - String vidName = 'vidName'; - String vidPath = 'vidPath'; - String address = 'address'; - String latitute = 'latitute'; - String longitute = 'longitute'; - String thumbnail = 'thumbnail'; - String cloudStatus = 'cloudStatus'; - String time = 'time'; + static DatabaseHelper? _databaseHelper; // Singleton DatabaseHelper + static Database? _database; // Singleton Database + + static const String vidTable = 'vid_table'; + static const String colId = 'id'; + static const String vidName = 'vidName'; + static const String vidPath = 'vidPath'; + static const String address = 'address'; + static const String latitute = 'latitute'; + static const String longitute = 'longitute'; + static const String thumbnail = 'thumbnail'; + static const String cloudStatus = 'cloudStatus'; + static const String time = 'time'; DatabaseHelper._createInstance(); // Named constructor to create instance of DatabaseHelper @@ -26,14 +26,14 @@ class DatabaseHelper { _databaseHelper = DatabaseHelper ._createInstance(); // This is executed only once, singleton object } - return _databaseHelper; + return _databaseHelper!; } Future get database async { if (_database == null) { _database = await initializeDatabase(); } - return _database; + return _database!; } Future initializeDatabase() async { @@ -42,21 +42,25 @@ class DatabaseHelper { String path = directory.path + 'vids.db'; // Open/create the database at a given path - var vidsDatabase = - await openDatabase(path, version: 1, onCreate: _createDb); + var vidsDatabase = await openDatabase( + path, + version: 1, + onCreate: _createDb, + ); return vidsDatabase; } void _createDb(Database db, int newVersion) async { await db.execute( - 'CREATE TABLE $vidTable($colId INTEGER PRIMARY KEY AUTOINCREMENT, $vidName TEXT, $vidPath TEXT, $address TEXT, $latitute TEXT, $longitute TEXT, $thumbnail, $cloudStatus TEXT, $time TEXT)'); + 'CREATE TABLE vid_table(id INTEGER PRIMARY KEY AUTOINCREMENT, vidName TEXT, vidPath TEXT, address TEXT, latitute TEXT, longitute TEXT, thumbnail TEXT, cloudStatus TEXT, time TEXT)', + ); } // Fetch Operation: Get all vid objects from database Future>> getVidMapList() async { Database db = await this.database; -// var result = await db.rawQuery('SELECT * FROM $vidTable order by $colTitle ASC'); + // var result = await db.rawQuery('SELECT * FROM $vidTable order by $colTitle ASC'); var result = await db.query(vidTable, orderBy: '$colId DESC'); return result; } @@ -71,31 +75,44 @@ class DatabaseHelper { // Update Operation: Update a Video object and save it to database Future updateVideo(VideoModel vid) async { var db = await this.database; - var result = await db.update(vidTable, vid.toMap(), - where: '$colId = ?', whereArgs: [vid.id]); + var result = await db.update( + vidTable, + vid.toMap(), + where: '$colId = ?', + whereArgs: [vid.id], + ); return result; } Future updateVideoCompleted(VideoModel vid) async { var db = await this.database; - var result = await db.update(vidTable, vid.toMap(), - where: '$colId = ?', whereArgs: [vid.id]); + var result = await db.update( + vidTable, + vid.toMap(), + where: '$colId = ?', + whereArgs: [vid.id], + ); return result; } // Delete Operation: Delete a Video object from database Future deleteVideo(int id) async { var db = await this.database; - int result = - await db.delete(vidTable, where: '$colId = ?', whereArgs: [id]); + int result = await db.delete( + vidTable, + where: '$colId = ?', + whereArgs: [id], + ); return result; } // Get number of Video objects in database Future getCount() async { Database db = await this.database; - List> x = - await db.query(vidTable, columns: ['COUNT(*)']); + List> x = await db.query( + vidTable, + columns: ['COUNT(*)'], + ); int result = Sqflite.firstIntValue(x) ?? 0; return result; } diff --git a/pubspec.yaml b/pubspec.yaml index a144185..692ec93 100644 --- a/pubspec.yaml +++ b/pubspec.yaml @@ -12,7 +12,9 @@ dependencies: sdk: flutter flutter_web_plugins: sdk: flutter + path_provider: ^2.1.5 plugin_platform_interface: ^2.0.2 + sqflite: ^2.4.2+1 dev_dependencies: flutter_test: From 73e96e1b1dfc68260d394a44e1c4a34468236fcd Mon Sep 17 00:00:00 2001 From: LimaniBhavik <6619586+LimaniBhavik@users.noreply.github.com> Date: Mon, 18 May 2026 12:30:32 +0000 Subject: [PATCH 2/2] style: format code to resolve CI formatting failures - Ran `dart format .` on the entire project to fix the `dart format --output=none --set-exit-if-changed .` pipeline failure. --- example/lib/main.dart | 3 ++- lib/video_watermark.dart | 3 ++- lib/video_watermark_method_channel.dart | 3 ++- test/video_model_test.dart | 3 ++- test/video_watermark_web_test.dart | 5 ++++- 5 files changed, 12 insertions(+), 5 deletions(-) diff --git a/example/lib/main.dart b/example/lib/main.dart index 02f1d6b..72b13f6 100644 --- a/example/lib/main.dart +++ b/example/lib/main.dart @@ -17,7 +17,8 @@ class MyApp extends StatelessWidget { child: ElevatedButton( onPressed: () async { final watermark = VideoWatermark(); - String? result = await watermark.addWatermark('test.mp4', 'Watermark text'); + String? result = + await watermark.addWatermark('test.mp4', 'Watermark text'); print(result); }, child: const Text('Add Watermark'), diff --git a/lib/video_watermark.dart b/lib/video_watermark.dart index eb2463c..757ef52 100644 --- a/lib/video_watermark.dart +++ b/lib/video_watermark.dart @@ -6,6 +6,7 @@ class VideoWatermark { } Future addWatermark(String videoPath, String watermarkText) { - return VideoWatermarkPlatform.instance.addWatermark(videoPath, watermarkText); + return VideoWatermarkPlatform.instance + .addWatermark(videoPath, watermarkText); } } diff --git a/lib/video_watermark_method_channel.dart b/lib/video_watermark_method_channel.dart index 622ecbc..4f0d37e 100644 --- a/lib/video_watermark_method_channel.dart +++ b/lib/video_watermark_method_channel.dart @@ -8,7 +8,8 @@ class MethodChannelVideoWatermark extends VideoWatermarkPlatform { @override Future getPlatformVersion() async { - final version = await methodChannel.invokeMethod('getPlatformVersion'); + final version = + await methodChannel.invokeMethod('getPlatformVersion'); return version; } diff --git a/test/video_model_test.dart b/test/video_model_test.dart index b670441..81832cd 100644 --- a/test/video_model_test.dart +++ b/test/video_model_test.dart @@ -73,7 +73,8 @@ void main() { expect(video.time, '2023-10-27 10:00:00'); }); - test('Setters should respect length constraints and update correct fields', () { + test('Setters should respect length constraints and update correct fields', + () { final video = VideoModel('', '', '', '', '', '', ''); video.vidName = 'New Name'; diff --git a/test/video_watermark_web_test.dart b/test/video_watermark_web_test.dart index d6e4e6f..da2392e 100644 --- a/test/video_watermark_web_test.dart +++ b/test/video_watermark_web_test.dart @@ -13,7 +13,10 @@ void main() { final result = await webPlugin.addWatermark(videoPath, watermarkText); - expect(result, equals('WASM watermarked version of $videoPath with text $watermarkText')); + expect( + result, + equals( + 'WASM watermarked version of $videoPath with text $watermarkText')); }); }); }