Prevent potential sql injection in get_game

lutris/pga.py

@@ -234,13 +234,16 @@ def get_games(
     name_filter=None,
     filter_installed=False,
     filter_runner=None,
-    select="*",
+    select=None,
     show_installed_first=False,
 ):
     """Get the list of every game in database."""
-    query = "select " + select + " from games"
+    query = "select * from games"
     params = []
     filters = []
+    if select:
+        query = "select ? from games"
+        params.append(select)
     if name_filter:
         params.append(name_filter)
         filters.append("name LIKE ?")

tests/test_pga.py

@@ -64,6 +64,12 @@ class TestPersonnalGameArchive(DatabaseTester):
         game = pga.get_game_by_field("some-game", "slug")
         self.assertEqual(game['directory'], '/foo')
 
+    def test_get_games_is_safe(self):
+        try:
+            pga.get_games(select="; asdf")
+        except OperationalError:
+            self.fail()
+
 
 class TestDbCreator(DatabaseTester):
     def test_can_generate_fields(self):