Merge pull request #634 from christianlouis/sentinel-fix-sql-injection-db-migrate-454366986287082539

🛡️ Sentinel: [SECURITY] Fix potential SQL injection in db_migrate
2026-03-14 09:33:13 +01:00
parent 4a46f372b9 82b1f89332
commit d97fda4840
1 changed files with 2 additions and 1 deletions
@@ -85,7 +85,8 @@ def preview_migration(source_url: str) -> dict[str, Any]:
        with src_engine.connect() as conn:
            for table_name in tables:
                # table_name is safe — sourced from inspect().get_table_names(), not user input
-                row = conn.execute(text(f'SELECT COUNT(*) FROM "{table_name}"')).fetchone()  # noqa: S608
+                quoted_table = conn.dialect.identifier_preparer.quote(table_name)
+                row = conn.execute(text(f"SELECT COUNT(*) FROM {quoted_table}")).fetchone()  # noqa: S608
                count = row[0] if row else 0
                result.append({"name": table_name, "row_count": count})
                total += count