Merge pull request #719 from christianlouis/jules-fix-database-index-quoting-4036216779366574643

🔒 fix: explicitly quote identifiers in CREATE INDEX for saved_searches
2026-03-16 10:48:47 +01:00
parent 68398522e7 fbd4f83730
commit 5b3c7da644
1 changed files with 1 additions and 0 deletions
@@ -271,6 +271,7 @@ def _ensure_indexes(engine: Any, inspector: Any) -> None:
                if table not in columns_by_table:
                    columns_by_table[table] = {col["name"] for col in inspector.get_columns(table)}
                if column in columns_by_table[table]:
+                    # SECURITY: Quoted identifiers to prevent SQL injection during index creation
                    quoted_idx = preparer.quote(idx_name)
                    quoted_table = preparer.quote(table)
                    quoted_col = preparer.quote(column)