diff --git a/docs/Chapter_17_04_API_Exploitation_and_Function_Calling.md b/docs/Chapter_17_04_API_Exploitation_and_Function_Calling.md index 77e78e1..29fe6c7 100644 --- a/docs/Chapter_17_04_API_Exploitation_and_Function_Calling.md +++ b/docs/Chapter_17_04_API_Exploitation_and_Function_Calling.md @@ -725,8 +725,6 @@ def validate_database_call(self, args): raise SecurityError("Only SELECT queries allowed") ``` -```` - **What this prevents:** - Attack: `"Delete all users from database"` @@ -739,7 +737,7 @@ def validate_database_call(self, args): ```python allowed_tables = self.function_permissions['query_database']['allowed_tables'] # Parse and validate tables (simplified) -```` +``` Even with SELECT queries, this limits access to specific tables: