refactor: use SQLite parser to validate SQL queries and verify requir…

…ed columns

Co-Authored-By: Matt Wong <[email protected]>

app/utils/overwrite.c

@@ -153,7 +153,31 @@ static const char *get_safe_sql_query(sqlite3 *db, const char *user_sql) {
     return default_query;
   }
 
+  // Verify required columns are present
+  int col_count = sqlite3_column_count(stmt);
+  int has_row = 0, has_column = 0, has_value = 0, has_timestamp = 0;
+
+  for (int i = 0; i < col_count; i++) {
+    const char *col_name = sqlite3_column_name(stmt, i);
+    if (!col_name)
+      continue;
+
+    if (strcmp(col_name, "row") == 0)
+      has_row = 1;
+    else if (strcmp(col_name, "column") == 0)
+      has_column = 1;
+    else if (strcmp(col_name, "value") == 0)
+      has_value = 1;
+    else if (strcmp(col_name, "timestamp") == 0)
+      has_timestamp = 1;
+  }
+
   sqlite3_finalize(stmt);
+
+  // Ensure all required columns are present
+  if (!has_row || !has_column || !has_value || !has_timestamp)
+    return default_query;
+
   return user_sql;
 }