In snapshot.go, getTableCount() constructs SQL via string formatting:
query:=fmt.Sprintf("SELECT COUNT(*) FROM %s",tableName)
Currently only called with hardcoded table names ("files", "chunks", "blobs"), so not exploitable today. However, this is a footgun — if anyone ever passes user input, it becomes SQL injection. Should use a whitelist of allowed table names or parameterize differently.
In `snapshot.go`, `getTableCount()` constructs SQL via string formatting:
```go
query := fmt.Sprintf("SELECT COUNT(*) FROM %s", tableName)
```
Currently only called with hardcoded table names (`"files"`, `"chunks"`, `"blobs"`), so not exploitable today. However, this is a footgun — if anyone ever passes user input, it becomes SQL injection. Should use a whitelist of allowed table names or parameterize differently.
Ref: parent issue #1
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
In
snapshot.go,getTableCount()constructs SQL via string formatting:Currently only called with hardcoded table names (
"files","chunks","blobs"), so not exploitable today. However, this is a footgun — if anyone ever passes user input, it becomes SQL injection. Should use a whitelist of allowed table names or parameterize differently.Ref: parent issue #1
Taking this on now. Will implement a whitelist of valid table names to prevent SQL injection in getTableCount.