From 838dec419050f60fa8cf98f4d355cfa1fdf794d6 Mon Sep 17 00:00:00 2001
From: "aikido-autofix[bot]"
 <119856028+aikido-autofix[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 08:48:59 +0000
Subject: [PATCH 1/2] fix(security): autofix Potential SQL injection via
 string-based query concatenation

---
 cli/templates/integrations/neon/files/lib/neon-client.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/cli/templates/integrations/neon/files/lib/neon-client.ts b/cli/templates/integrations/neon/files/lib/neon-client.ts
index 6be858b7d6..5b54d69bbb 100644
--- a/cli/templates/integrations/neon/files/lib/neon-client.ts
+++ b/cli/templates/integrations/neon/files/lib/neon-client.ts
@@ -251,6 +251,12 @@ export async function getTableRowCount(
   tableName: string,
   schema: string = "public",
 ): Promise<number> {
+  if (!/^[a-zA-Z0-9_]+$/.test(schema)) {
+    throw new Error('Invalid input');
+  }
+  if (!/^[a-zA-Z0-9_]+$/.test(tableName)) {
+    throw new Error('Invalid input');
+  }
   const result = await query<{ count: string }>(
     `SELECT COUNT(*) as count FROM "${schema}"."${tableName}"`,
   );

From ce814b601e123727adca42d546713cb8b7344753 Mon Sep 17 00:00:00 2001
From: Koji Wakayama <agent1@Kojis-MacBook-Pro-2.local>
Date: Fri, 27 Mar 2026 10:35:18 +0100
Subject: [PATCH 2/2] fix: improve SQL injection guard error messages for
 neon-client

Replace generic "Invalid input" error messages with descriptive messages
that tell the user exactly what characters are allowed in schema/table names.
---
 cli/templates/integrations/neon/files/lib/neon-client.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cli/templates/integrations/neon/files/lib/neon-client.ts b/cli/templates/integrations/neon/files/lib/neon-client.ts
index 5b54d69bbb..70c044a38c 100644
--- a/cli/templates/integrations/neon/files/lib/neon-client.ts
+++ b/cli/templates/integrations/neon/files/lib/neon-client.ts
@@ -252,10 +252,10 @@ export async function getTableRowCount(
   schema: string = "public",
 ): Promise<number> {
   if (!/^[a-zA-Z0-9_]+$/.test(schema)) {
-    throw new Error('Invalid input');
+    throw new Error('Invalid schema name: must contain only letters, numbers, and underscores');
   }
   if (!/^[a-zA-Z0-9_]+$/.test(tableName)) {
-    throw new Error('Invalid input');
+    throw new Error('Invalid table name: must contain only letters, numbers, and underscores');
   }
   const result = await query<{ count: string }>(
     `SELECT COUNT(*) as count FROM "${schema}"."${tableName}"`,