getTableCount in internal/vaultik/snapshot.go uses fmt.Sprintf to interpolate a table name directly into a SQL query:
func(v*Vaultik)getTableCount(tableNamestring)(int64,error){query:=fmt.Sprintf("SELECT COUNT(*) FROM %s",tableName)err:=v.DB.Conn().QueryRowContext(v.ctx,query).Scan(&count)}
While currently only called with hardcoded table names (files, chunks, blobs), this is a dangerous pattern. If the function is ever called with user-provided input, it becomes a SQL injection vulnerability.
Fix
Validate the table name against an allowlist of known tables before interpolation.
## Bug
`getTableCount` in `internal/vaultik/snapshot.go` uses `fmt.Sprintf` to interpolate a table name directly into a SQL query:
```go
func (v *Vaultik) getTableCount(tableName string) (int64, error) {
query := fmt.Sprintf("SELECT COUNT(*) FROM %s", tableName)
err := v.DB.Conn().QueryRowContext(v.ctx, query).Scan(&count)
}
```
While currently only called with hardcoded table names (`files`, `chunks`, `blobs`), this is a dangerous pattern. If the function is ever called with user-provided input, it becomes a SQL injection vulnerability.
## Fix
Validate the table name against an allowlist of known tables before interpolation.
clawbot
self-assigned this 2026-02-08 21:01:09 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Bug
getTableCountininternal/vaultik/snapshot.gousesfmt.Sprintfto interpolate a table name directly into a SQL query:While currently only called with hardcoded table names (
files,chunks,blobs), this is a dangerous pattern. If the function is ever called with user-provided input, it becomes a SQL injection vulnerability.Fix
Validate the table name against an allowlist of known tables before interpolation.