Repository navigation
fix(security): resolve SQL injection risks in PostgreSQL backend - #35
Merged
Merged
Conversation
- Fix partial index where_clause to accept ToSQLProtocol for parameterized queries - Fix CREATE TYPE ENUM values to use _escape_sql_string for escaping - Fix trigger function name to use format_identifier for proper quoting - Fix stored procedure names (CREATE/DROP/CALL) to use format_identifier - Fix extended statistics names to use format_identifier Resolves: SQL injection vulnerabilities in PostgreSQL backend
The ToSQLProtocol path was collecting parameters but returning hardcoded empty tuple, causing WHERE clause parameters to be silently dropped. This commit fixes the return statement to include the collected parameters.
- Add tests for CREATE TYPE ENUM value escaping - Add tests for trigger function name format_identifier - Add tests for stored procedure names (CREATE/DROP/CALL) - Add tests for extended statistics names - Add tests for partial index WHERE clause ToSQLProtocol support Resolves: Test coverage for SQL injection fixes in PostgreSQL backend
- Fix method name: format_create_type_enum_statement - Fix method name: format_call_statement - Add all_params initialization in format_create_index_pg_statement - Add tests for ENUM escaping, stored procedures, and partial index WHERE clause
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release/v1.0.0.dev13 #35 +/- ##
========================================================
+ Coverage 68.66% 68.72% +0.06%
========================================================
Files 230 230
Lines 10049 10054 +5
Branches 1598 1599 +1
========================================================
+ Hits 6900 6910 +10
+ Misses 2628 2621 -7
- Partials 521 523 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
vistart
added a commit
that referenced
this pull request
May 15, 2026
* fix: resolve SQL injection risks in DDL/DML statements - Fix partial index where_clause to accept ToSQLProtocol for parameterized queries - Fix CREATE TYPE ENUM values to use _escape_sql_string for escaping - Fix trigger function name to use format_identifier for proper quoting - Fix stored procedure names (CREATE/DROP/CALL) to use format_identifier - Fix extended statistics names to use format_identifier Resolves: SQL injection vulnerabilities in PostgreSQL backend * fix: resolve parameter loss bug in where_clause The ToSQLProtocol path was collecting parameters but returning hardcoded empty tuple, causing WHERE clause parameters to be silently dropped. This commit fixes the return statement to include the collected parameters. * test: add SQL injection security tests for PostgreSQL fixes - Add tests for CREATE TYPE ENUM value escaping - Add tests for trigger function name format_identifier - Add tests for stored procedure names (CREATE/DROP/CALL) - Add tests for extended statistics names - Add tests for partial index WHERE clause ToSQLProtocol support Resolves: Test coverage for SQL injection fixes in PostgreSQL backend * test: fix and enhance PostgreSQL security tests - Fix method name: format_create_type_enum_statement - Fix method name: format_call_statement - Add all_params initialization in format_create_index_pg_statement - Add tests for ENUM escaping, stored procedures, and partial index WHERE clause * chore: use git source for rhosocial-activerecord at release/v1.0.0.dev26 * test: update test assertions for quoted identifiers * chore: add changelog fragment for PR #35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Resolves SQL injection risks in PostgreSQL backend by properly using parameterized queries.
Type of change
fix: A bug fixdocs: Documentation only changesperf: A code change that improves performancetest: Adding missing tests or correcting existing testschore: Changes to the build process or auxiliary toolsci: Changes to our CI configuration filesbuild: Changes that affect the build systemrevert: Reverts a previous commitBreaking Change
Applicable
rhosocial-activerecordVersion Range:Related Repositories/Packages
Testing
Test Plan:
Ran security tests for SQL injection prevention.
Checklist
changelog.d/<issue_number>.<type>.md).Additional Notes
Commit history since branching from release/v1.0.0.dev13:
4a08618chore: use git source for rhosocial-activerecord at release/v1.0.0.dev26e7fd370test: fix and enhance PostgreSQL security tests3c2b0e2test: add SQL injection security tests for PostgreSQL fixes53495b6fix: resolve parameter loss bug in where_claused06af9ffix: resolve SQL injection risks in DDL/DML statements