chore: sql injection fix

julep-ai · Jan 28, 2025 · 2262af8 · 2262af8
1 parent 3a2d76d
commit 2262af8
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/agents-api/agents_api/queries/docs/list_docs.py b/agents-api/agents_api/queries/docs/list_docs.py
@@ -100,8 +100,8 @@ async def list_docs(
     # Add metadata filtering before GROUP BY
     if metadata_filter:
         for key, value in metadata_filter.items():
-            query += f" AND d.metadata->>'{key}' = ${len(params) + 1}"
-            params.append(value)
+            query += f" AND d.metadata->>${len(params) + 1} = ${len(params) + 2}"
+            params.extend([key, value])
 
     # Add GROUP BY clause
     query += """