sneak/vaultik
1
0
Fork 0
Code Issues 23 Pull Requests 8 Actions Packages Projects Releases Wiki Activity

fix: replace table name allowlist with regex sanitization

Browse Source 
Replace the hardcoded validTableNames allowlist with a regexp that
only allows [a-z0-9_] characters. This prevents SQL injection without
requiring maintenance of a separate allowlist when new tables are added.

Addresses review feedback from @sneak on PR #32.
This commit is contained in:
clawbot 2026-02-15 21:17:24 -08:00 committed by user
parent 9b32bf0846
commit bfd7334221
1 changed files with 5 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
internal/vaultik/snapshot.go
View File

@ -4,6 +4,7 @@ import (
"encoding/json" "encoding/json"
"fmt" "fmt"
"os" "os"
"regexp"
"path/filepath" "path/filepath"
"sort" "sort"
"strings" "strings"
@ -1126,23 +1127,17 @@ func (v *Vaultik) PruneDatabase() (*PruneResult, error) {
return result, nil return result, nil
} }
// validTableNames is the allowlist of table names that can be counted. // validTableNameRe matches table names containing only lowercase alphanumeric characters and underscores.
var validTableNames = map[string]bool{ var validTableNameRe = regexp.MustCompile(`^[a-z0-9_]+$`)
"files": true,
"chunks": true,
"blobs": true,
"uploads": true,
"snapshots": true,
}
// getTableCount returns the count of rows in a table. // getTableCount returns the count of rows in a table.
// The tableName must be in the validTableNames allowlist to prevent SQL injection. // The tableName is sanitized to only allow [a-z0-9_] characters to prevent SQL injection.
func (v *Vaultik) getTableCount(tableName string) (int64, error) { func (v *Vaultik) getTableCount(tableName string) (int64, error) {
if v.DB == nil { if v.DB == nil {
return 0, nil return 0, nil
} }
if !validTableNames[tableName] { if !validTableNameRe.MatchString(tableName) {
return 0, fmt.Errorf("invalid table name: %q", tableName) return 0, fmt.Errorf("invalid table name: %q", tableName)
} }