getTableCount uses fmt.Sprintf for SQL table name — potential SQL injection #7

New Issue

clawbot · 2026-02-08T17:16:22+01:00

clawbot commented

2026-02-08 17:16:22 +01:00

In snapshot.go, getTableCount() constructs SQL via string formatting:

query := fmt.Sprintf("SELECT COUNT(*) FROM %s", tableName)

Currently only called with hardcoded table names ("files", "chunks", "blobs"), so not exploitable today. However, this is a footgun — if anyone ever passes user input, it becomes SQL injection. Should use a whitelist of allowed table names or parameterize differently.

Ref: parent issue #1

In `snapshot.go`, `getTableCount()` constructs SQL via string formatting: ```go query := fmt.Sprintf("SELECT COUNT(*) FROM %s", tableName) ``` Currently only called with hardcoded table names (`"files"`, `"chunks"`, `"blobs"`), so not exploitable today. However, this is a footgun — if anyone ever passes user input, it becomes SQL injection. Should use a whitelist of allowed table names or parameterize differently. Ref: parent issue #1

clawbot referenced this issue

2026-02-08 17:17:10 +01:00

find bugs or incomplete functionality for 1.0 #1

clawbot self-assigned this 2026-02-20 09:29:27 +01:00

clawbot added the

needs-review

label 2026-02-20 09:29:28 +01:00

clawbot commented

2026-02-20 11:04:42 +01:00

Taking this on now. Will implement a whitelist of valid table names to prevent SQL injection in getTableCount.

clawbot referenced this issue from a commit

2026-02-20 11:09:42 +01:00