From 433d1eb63924bb70654d51667da2e71a543e9b60 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 09:11:57 +0000 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=94=92=20Fix=20potential=20SQL=20inje?= =?UTF-8?q?ction=20in=20db=5Fmigrate=20preview?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added a strict regex validation allowlist for table names in `preview_migration` before using them in raw SQL queries. This ensures that only alphanumeric characters and underscores are allowed, preventing potential SQL injection even if the source of table names were to be manipulated. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- app/utils/db_migrate.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/app/utils/db_migrate.py b/app/utils/db_migrate.py index c84da88d..c9558f29 100644 --- a/app/utils/db_migrate.py +++ b/app/utils/db_migrate.py @@ -12,6 +12,7 @@ The utility: """ import logging +import re from typing import Any from sqlalchemy import MetaData, create_engine, inspect, text @@ -84,6 +85,9 @@ def preview_migration(source_url: str) -> dict[str, Any]: total = 0 with src_engine.connect() as conn: for table_name in tables: + if not re.match(r'^[a-zA-Z0-9_]+$', table_name): + logger.warning(f"Skipping table with invalid name format: {table_name}") + continue # table_name is safe — sourced from inspect().get_table_names(), not user input quoted_table = conn.dialect.identifier_preparer.quote(table_name) row = conn.execute(text(f"SELECT COUNT(*) FROM {quoted_table}")).fetchone() # noqa: S608 From 2cfbea29a9211abfc13b74dea0a841fe5a2546b9 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 16 Mar 2026 09:12:15 +0000 Subject: [PATCH 2/2] style: apply ruff auto-fix - Auto-formatted code with ruff format - Applied ruff linting fixes with --fix Co-authored-by: github-actions[bot] --- app/utils/db_migrate.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/utils/db_migrate.py b/app/utils/db_migrate.py index c9558f29..78f87fca 100644 --- a/app/utils/db_migrate.py +++ b/app/utils/db_migrate.py @@ -85,7 +85,7 @@ def preview_migration(source_url: str) -> dict[str, Any]: total = 0 with src_engine.connect() as conn: for table_name in tables: - if not re.match(r'^[a-zA-Z0-9_]+$', table_name): + if not re.match(r"^[a-zA-Z0-9_]+$", table_name): logger.warning(f"Skipping table with invalid name format: {table_name}") continue # table_name is safe — sourced from inspect().get_table_names(), not user input