From 82b1f89332d7bb3e7d8a16651b17a060e8ae4d0f Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 14 Mar 2026 03:39:53 +0000
Subject: [PATCH] fix(security): prevent potential SQL injection in database
 migration

Replaced manual double-quoting of table names with SQLAlchemy's dialect-specific
identifier preparer in `app/utils/db_migrate.py`. This ensures proper quoting
for any database dialect and acts as a defense-in-depth measure against
SQL injection or syntax errors if a table name contains unexpected characters.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/utils/db_migrate.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/utils/db_migrate.py b/app/utils/db_migrate.py
index 3424009d..c84da88d 100644
--- a/app/utils/db_migrate.py
+++ b/app/utils/db_migrate.py
@@ -85,7 +85,8 @@ def preview_migration(source_url: str) -> dict[str, Any]:
         with src_engine.connect() as conn:
             for table_name in tables:
                 # table_name is safe — sourced from inspect().get_table_names(), not user input
-                row = conn.execute(text(f'SELECT COUNT(*) FROM "{table_name}"')).fetchone()  # noqa: S608
+                quoted_table = conn.dialect.identifier_preparer.quote(table_name)
+                row = conn.execute(text(f"SELECT COUNT(*) FROM {quoted_table}")).fetchone()  # noqa: S608
                 count = row[0] if row else 0
                 result.append({"name": table_name, "row_count": count})
                 total += count