gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #719 from christianlouis/jules-fix-database-index-quoting-4036216779366574643

Browse Source 
🔒 fix: explicitly quote identifiers in CREATE INDEX for saved_searches
This commit is contained in:
Christian Krakau-Louis
2026-03-16 10:48:47 +01:00
committed by GitHub
parent 68398522e7 fbd4f83730
commit 5b3c7da644
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/database.py
+1
View File
@@ -271,6 +271,7 @@ def _ensure_indexes(engine: Any, inspector: Any) -> None:
if table not in columns_by_table: if table not in columns_by_table:
columns_by_table[table] = {col["name"] for col in inspector.get_columns(table)} columns_by_table[table] = {col["name"] for col in inspector.get_columns(table)}
if column in columns_by_table[table]: if column in columns_by_table[table]:
# SECURITY: Quoted identifiers to prevent SQL injection during index creation
quoted_idx = preparer.quote(idx_name) quoted_idx = preparer.quote(idx_name)
quoted_table = preparer.quote(table) quoted_table = preparer.quote(table)
quoted_col = preparer.quote(column) quoted_col = preparer.quote(column)