Skip to content

Log invalid use of _cf_ table prefix#6446

Closed
maxmcd wants to merge 1 commit intomainfrom
mmcdonnell/VULN-129365-logs
Closed

Log invalid use of _cf_ table prefix#6446
maxmcd wants to merge 1 commit intomainfrom
mmcdonnell/VULN-129365-logs

Conversation

@maxmcd
Copy link
Copy Markdown
Contributor

@maxmcd maxmcd commented Mar 27, 2026

Add warning logs to detect SQL identifiers using mixed-case cf prefix variants (e.g. CF, Cf) and FTS5 virtual tables using any-case cf prefix.

@maxmcd maxmcd requested review from a team as code owners March 27, 2026 20:47
@ask-bonk
Copy link
Copy Markdown
Contributor

ask-bonk bot commented Mar 27, 2026

LGTM

github run

@maxmcd maxmcd closed this Mar 27, 2026
@maxmcd maxmcd deleted the mmcdonnell/VULN-129365-logs branch March 27, 2026 20:59
@kentonv
Copy link
Copy Markdown
Member

kentonv commented Mar 27, 2026

It's annoying that github does not allow deleting a PR. Luckily this isn't actually a vulnerability (nothing you can actually exploit by using table names starting with _cf_), it's just that it's something we intended to disallow and it turns out it's not always disallowed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants