From fb8aef3e2a4bb2c1e97014553a2795341327203e Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 09:27:02 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20potential=20SQL=20injectio?=
 =?UTF-8?q?n=20in=20db=5Fmigrate=20preview?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added a strict regex validation allowlist for table names in `preview_migration` before using them in raw SQL queries. This ensures that only alphanumeric characters and underscores are allowed, preventing potential SQL injection even if the source of table names were to be manipulated. Formatted code with ruff format.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/utils/db_migrate.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/utils/db_migrate.py b/app/utils/db_migrate.py
index c84da88d..78f87fca 100644
--- a/app/utils/db_migrate.py
+++ b/app/utils/db_migrate.py
@@ -12,6 +12,7 @@ The utility:
 """
 
 import logging
+import re
 from typing import Any
 
 from sqlalchemy import MetaData, create_engine, inspect, text
@@ -84,6 +85,9 @@ def preview_migration(source_url: str) -> dict[str, Any]:
         total = 0
         with src_engine.connect() as conn:
             for table_name in tables:
+                if not re.match(r"^[a-zA-Z0-9_]+$", table_name):
+                    logger.warning(f"Skipping table with invalid name format: {table_name}")
+                    continue
                 # table_name is safe — sourced from inspect().get_table_names(), not user input
                 quoted_table = conn.dialect.identifier_preparer.quote(table_name)
                 row = conn.execute(text(f"SELECT COUNT(*) FROM {quoted_table}")).fetchone()  # noqa: S608