Skip to content

v1.0.7

Choose a tag to compare

View all tags
@jtayal-stripe jtayal-stripe released this 03 Jul 13:29
· 2 commits to main since this release
v1.0.7
This tag was signed with the committer’s verified signature.
jtayal-stripe Jatin Tayal
SSH Key Fingerprint: 7/pizKOwyTH4ZPgAc/mrWpqiX81+lggcP9OwR+83GZw
Verified
Learn about vigilant mode.
6208f8f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security fixes

Fixes two additional SQL injection sinks identified via the same root cause as v1.0.6 (enum labels, #295). Schema-derived values were re-emitted into generated DDL without proper escaping.

Policy role names (policy_sql_generator.go)

AppliesTo role names (sourced from pg_roles.rolname) were interpolated raw into CREATE POLICY ... TO and ALTER POLICY ... TO statements. A user with CREATEROLE privilege could plant a role whose name contains an embedded double-quote to inject arbitrary SQL during plan execution.

Fix: Added escapeRoleNames() helper that applies EscapeIdentifier to each role name, preserving PUBLIC as an unquoted SQL keyword.

Function/procedure names (schema.go buildProcName)

The function used hand-rolled quoting (fmt.Sprintf("\"%s\"(%s)", name, ...)) that did not double embedded double-quotes. A user with CREATE FUNCTION privilege could create a function with " in its name to inject SQL when DROP FUNCTION/DROP PROCEDURE statements are generated.

Fix: Replaced the hand-rolled quoting with EscapeIdentifier(name).

What's Changed

  • fix: escape policy role names and function/procedure names in generated SQL (#296)

Full Changelog: v1.0.6...v1.0.7

Assets 2
Loading