From 433d1eb63924bb70654d51667da2e71a543e9b60 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 09:11:57 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20potential=20SQL=20injectio?=
 =?UTF-8?q?n=20in=20db=5Fmigrate=20preview?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added a strict regex validation allowlist for table names in `preview_migration` before using them in raw SQL queries. This ensures that only alphanumeric characters and underscores are allowed, preventing potential SQL injection even if the source of table names were to be manipulated.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/utils/db_migrate.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/utils/db_migrate.py b/app/utils/db_migrate.py
index c84da88d..c9558f29 100644
--- a/app/utils/db_migrate.py
+++ b/app/utils/db_migrate.py
@@ -12,6 +12,7 @@ The utility:
 """
 
 import logging
+import re
 from typing import Any
 
 from sqlalchemy import MetaData, create_engine, inspect, text
@@ -84,6 +85,9 @@ def preview_migration(source_url: str) -> dict[str, Any]:
         total = 0
         with src_engine.connect() as conn:
             for table_name in tables:
+                if not re.match(r'^[a-zA-Z0-9_]+$', table_name):
+                    logger.warning(f"Skipping table with invalid name format: {table_name}")
+                    continue
                 # table_name is safe — sourced from inspect().get_table_names(), not user input
                 quoted_table = conn.dialect.identifier_preparer.quote(table_name)
                 row = conn.execute(text(f"SELECT COUNT(*) FROM {quoted_table}")).fetchone()  # noqa: S608