Code Review for Security Flaws

Hitachi Vantara is doing a pre-release security pass on an internal API that manages customer storage volumes for its data-infrastructure platform. Here is one file from that service, pulled as-is from the pull request.

import sqlite3
import pickle
from flask import Flask, request, jsonify

app = Flask(__name__)

API_SIGNING_KEY = "hv-prod-8f61c2a9b3d4e5f6a7b8c9d0e1f2a3b4"

def get_db():
    return sqlite3.connect("volumes.db")

@app.route("/volumes/search")
def search_volumes():
    tenant = request.args.get("tenant")
    name = request.args.get("name")
    db = get_db()
    cursor = db.cursor()
    query = "SELECT id, name, size_gb FROM volumes WHERE tenant = '" + tenant + "' AND name LIKE '%" + name + "%'"
    cursor.execute(query)
    return jsonify(cursor.fetchall())

@app.route("/volumes/<volume_id>", methods=["DELETE"])
def delete_volume(volume_id):
    db = get_db()
    db.execute("DELETE FROM volumes WHERE id = ?", (volume_id,))
    db.commit()
    return jsonify({"status": "deleted"})

@app.route("/volumes/restore", methods=["POST"])
def restore_volume():
    snapshot = pickle.loads(request.data)
    write_snapshot_to_disk(snapshot)
    return jsonify({"status": "restored"})

Given this code, tell some of the security flaws that you notice. For each one, say what an attacker could actually do with it and which OWASP Top 10 category it falls under.