sneak/vaultik
1
0
Fork 0
Code Issues 3 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: use whitelist for SQL table names in getTableCount (closes #7) #38

Closed
clawbot wants to merge 2 commits from fix/sql-injection-whitelist into main
pull from: fix/sql-injection-whitelist
merge into: :main
Conversation 3 Commits 2 Files Changed 2
+66 -9
clawbot commented 2026-02-20 11:09:53 +01:00
Collaborator
Copy Link
Copy Source

Summary

Replace regex-based validation in getTableCount() with a strict whitelist of allowed table names (files, chunks, blobs). The whitelist check now runs before the nil-DB early return, ensuring invalid names are always rejected regardless of DB state.

Also removes the now-unused regexp import.

Test

Added table_count_test.go with tests for:

  • Whitelist completeness
  • Allowed names pass through
  • SQL injection attempts rejected
  • Unknown table names rejected
  • Empty string rejected
  • Case sensitivity

make test output

0 issues.
ok  git.eeqj.de/sneak/vaultik/internal/blob
ok  git.eeqj.de/sneak/vaultik/internal/blobgen
ok  git.eeqj.de/sneak/vaultik/internal/chunker
ok  git.eeqj.de/sneak/vaultik/internal/cli
ok  git.eeqj.de/sneak/vaultik/internal/config
ok  git.eeqj.de/sneak/vaultik/internal/crypto
ok  git.eeqj.de/sneak/vaultik/internal/database
ok  git.eeqj.de/sneak/vaultik/internal/globals
ok  git.eeqj.de/sneak/vaultik/internal/models
ok  git.eeqj.de/sneak/vaultik/internal/pidlock
ok  git.eeqj.de/sneak/vaultik/internal/s3
ok  git.eeqj.de/sneak/vaultik/internal/snapshot
ok  git.eeqj.de/sneak/vaultik/internal/vaultik

All tests pass, 0 lint issues.

## Summary Replace regex-based validation in `getTableCount()` with a strict whitelist of allowed table names (`files`, `chunks`, `blobs`). The whitelist check now runs before the nil-DB early return, ensuring invalid names are always rejected regardless of DB state. Also removes the now-unused `regexp` import. ## Test Added `table_count_test.go` with tests for: - Whitelist completeness - Allowed names pass through - SQL injection attempts rejected - Unknown table names rejected - Empty string rejected - Case sensitivity ## make test output ``` 0 issues. ok git.eeqj.de/sneak/vaultik/internal/blob ok git.eeqj.de/sneak/vaultik/internal/blobgen ok git.eeqj.de/sneak/vaultik/internal/chunker ok git.eeqj.de/sneak/vaultik/internal/cli ok git.eeqj.de/sneak/vaultik/internal/config ok git.eeqj.de/sneak/vaultik/internal/crypto ok git.eeqj.de/sneak/vaultik/internal/database ok git.eeqj.de/sneak/vaultik/internal/globals ok git.eeqj.de/sneak/vaultik/internal/models ok git.eeqj.de/sneak/vaultik/internal/pidlock ok git.eeqj.de/sneak/vaultik/internal/s3 ok git.eeqj.de/sneak/vaultik/internal/snapshot ok git.eeqj.de/sneak/vaultik/internal/vaultik ``` All tests pass, 0 lint issues.
clawbot added the needs-checks label 2026-02-20 11:09:53 +01:00
clawbot self-assigned this 2026-02-20 11:09:53 +01:00
clawbot added 1 commit 2026-02-20 11:09:53 +01:00
fix: use whitelist for SQL table names in getTableCount (closes #7) bb4b9b5bc9 
Replace regex-based validation with a strict whitelist of allowed table
names (files, chunks, blobs). The whitelist check now runs before the
nil-DB early return so invalid names are always rejected.

Removes unused regexp import.
sneak added 1 commit 2026-02-20 11:16:28 +01:00
Merge branch 'main' into fix/sql-injection-whitelist 3e282af516
clawbot commented 2026-02-20 11:17:13 +01:00
Author
Collaborator
Copy Link
Copy Source

make test output (lint + tests)

✅ All checks pass — 0 lint issues, all tests PASS.

golangci-lint run
0 issues.

ok  git.eeqj.de/sneak/vaultik/internal/blob       0.787s
ok  git.eeqj.de/sneak/vaultik/internal/blobgen    0.322s
ok  git.eeqj.de/sneak/vaultik/internal/chunker    0.197s
ok  git.eeqj.de/sneak/vaultik/internal/cli        1.492s
ok  git.eeqj.de/sneak/vaultik/internal/config     0.558s
ok  git.eeqj.de/sneak/vaultik/internal/crypto     0.810s
ok  git.eeqj.de/sneak/vaultik/internal/database   3.127s
ok  git.eeqj.de/sneak/vaultik/internal/globals    0.148s
ok  git.eeqj.de/sneak/vaultik/internal/models     1.964s
ok  git.eeqj.de/sneak/vaultik/internal/pidlock    0.663s
ok  git.eeqj.de/sneak/vaultik/internal/s3         3.506s
ok  git.eeqj.de/sneak/vaultik/internal/snapshot   3.872s
ok  git.eeqj.de/sneak/vaultik/internal/vaultik    3.000s
## `make test` output (lint + tests) ✅ **All checks pass** — 0 lint issues, all tests PASS. ``` golangci-lint run 0 issues. ok git.eeqj.de/sneak/vaultik/internal/blob 0.787s ok git.eeqj.de/sneak/vaultik/internal/blobgen 0.322s ok git.eeqj.de/sneak/vaultik/internal/chunker 0.197s ok git.eeqj.de/sneak/vaultik/internal/cli 1.492s ok git.eeqj.de/sneak/vaultik/internal/config 0.558s ok git.eeqj.de/sneak/vaultik/internal/crypto 0.810s ok git.eeqj.de/sneak/vaultik/internal/database 3.127s ok git.eeqj.de/sneak/vaultik/internal/globals 0.148s ok git.eeqj.de/sneak/vaultik/internal/models 1.964s ok git.eeqj.de/sneak/vaultik/internal/pidlock 0.663s ok git.eeqj.de/sneak/vaultik/internal/s3 3.506s ok git.eeqj.de/sneak/vaultik/internal/snapshot 3.872s ok git.eeqj.de/sneak/vaultik/internal/vaultik 3.000s ```
clawbot added merge-ready and removed needs-checks labels 2026-02-20 11:17:14 +01:00
clawbot removed their assignment 2026-02-20 11:17:14 +01:00
sneak was assigned by clawbot 2026-02-20 11:17:14 +01:00
sneak commented 2026-02-20 11:17:35 +01:00
Owner
Copy Link
Copy Source

why do we have this? table names aren’t user-supplied. it’s our own code. remove this nonsense.

why do we have this? table names aren’t user-supplied. it’s our own code. remove this nonsense.
clawbot closed this pull request 2026-02-20 11:17:47 +01:00
clawbot commented 2026-02-20 11:17:53 +01:00
Author
Collaborator
Copy Link
Copy Source

You're right — table names are hardcoded in our own code, not user-supplied. No attack vector. Closed.

You're right — table names are hardcoded in our own code, not user-supplied. No attack vector. Closed.

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
merge-ready
All checks pass, reviewed, rebased, ready for merge
 needs-checks
make check does not pass cleanly
 needs-rebase
PR has merge conflicts or is behind main
 needs-review
Code review not yet done
 needs-rework
Code review found issues to fix
No labels merge-ready
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees sneak
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/vaultik#38