user-1: Is SQL injection a possibility while using JSON-RPC and Descriptor wallet RPCs?
Consider one parameter in some descriptor wallet RPC is vulnerable and returns some data with SQL queries that shouldn't be returned. Will it really affect anything if RPC is only accessible from localhost?
Any difference in security when using REST API because I have not tried -rest option yet?

user48884: The vast majority of database entries are generated by the wallet and do not contain anything that the user can enter. Things that users can enter are generally validated prior to writing to the database, e.g. descriptors imported with importdescriptors must be valid descriptors before they are written.
The sole exception are labels which, by definition, contain user generated data. As such, if the record writing were implemented incorrectly, a user could use setlabel to perform a SQL injection attack. This is because the label string provided to setlabel must be provided directly to the SQL query that actually adds it to the database.
However Bitcoin Core's use of sqlite prevents SQL injection attacks. Bitcoin Core uses prepared statements so it is not possible to perform a SQL injection, barring some implementation error on the side of sqlite. These statements are prepared at the time the wallet is loaded. They are fixed queries and cannot be modified by the user.

-1: <p>Is SQL injection a possibility while using JSON-RPC and Descriptor wallet RPCs?</p>
<p>Consider one parameter in some descriptor wallet RPC is vulnerable and returns some data with SQL queries that shouldn't be returned. Will it really affect anything if RPC is only accessible from localhost?</p>
<p>Any difference in security when using REST API because I have not tried <code>-rest</code> option yet?</p>
 48884: <p>The vast majority of database entries are generated by the wallet and do not contain anything that the user can enter. Things that users can enter are generally validated prior to writing to the database, e.g. descriptors imported with <code>importdescriptors</code> must be valid descriptors before they are written.</p>
<p>The sole exception are labels which, by definition, contain user generated data. As such, if the record writing were implemented incorrectly, a user could use <code>setlabel</code> to perform a SQL injection attack. This is because the label string provided to <code>setlabel</code> must be provided directly to the SQL query that actually adds it to the database.</p>
<p>However Bitcoin Core's use of sqlite prevents SQL injection attacks. Bitcoin Core uses prepared statements so it is not possible to perform a SQL injection, barring some implementation error on the side of sqlite. These statements are prepared at the time the wallet is loaded. They are fixed queries and cannot be modified by the user.</p>
