vaultik

51 Commits 3 Branches 0 Tags

3 Commits

Author	SHA1	Message	Date
clawbot	bfd7334221	fix: replace table name allowlist with regex sanitization Replace the hardcoded validTableNames allowlist with a regexp that only allows [a-z0-9_] characters. This prevents SQL injection without requiring maintenance of a separate allowlist when new tables are added. Addresses review feedback from @sneak on PR #32.	2026-02-15 21:17:24 -08:00
clawbot	441c441eca	fix: prevent double-close of blobgen.Writer in CompressStream CompressStream had both a defer w.Close() and an explicit w.Close() call, causing the compressor and encryptor to be closed twice. The second close on the zstd encoder returns an error, and the age encryptor may write duplicate finalization bytes, potentially corrupting the output stream. Use a closed flag to prevent the deferred close from running after the explicit close succeeds.	2026-02-08 12:03:36 -08:00
clawbot	4d9f912a5f	fix: validate table name against allowlist in getTableCount to prevent SQL injection The getTableCount method used fmt.Sprintf to interpolate a table name directly into a SQL query. While currently only called with hardcoded names, this is a dangerous pattern. Added an allowlist of valid table names and return an error for unrecognized names.	2026-02-08 12:03:18 -08:00

Author

SHA1

Message

Date

clawbot

bfd7334221

fix: replace table name allowlist with regex sanitization

Replace the hardcoded validTableNames allowlist with a regexp that
only allows [a-z0-9_] characters. This prevents SQL injection without
requiring maintenance of a separate allowlist when new tables are added.

Addresses review feedback from @sneak on PR #32.

2026-02-15 21:17:24 -08:00

clawbot

441c441eca

fix: prevent double-close of blobgen.Writer in CompressStream

CompressStream had both a defer w.Close() and an explicit w.Close() call,
causing the compressor and encryptor to be closed twice. The second close
on the zstd encoder returns an error, and the age encryptor may write
duplicate finalization bytes, potentially corrupting the output stream.

Use a closed flag to prevent the deferred close from running after the
explicit close succeeds.

2026-02-08 12:03:36 -08:00

clawbot

4d9f912a5f

fix: validate table name against allowlist in getTableCount to prevent SQL injection

The getTableCount method used fmt.Sprintf to interpolate a table name directly
into a SQL query. While currently only called with hardcoded names, this is a
dangerous pattern. Added an allowlist of valid table names and return an error
for unrecognized names.

2026-02-08 12:03:18 -08:00