Skip to content

[Aikido] AI Fix for Potential SQL injection via string-based query concatenation #760

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kojiwakayama merged 2 commits into from
Mar 27, 2026
+6 −0
Merged

[Aikido] AI Fix for Potential SQL injection via string-based query concatenation #760

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
838dec4
fix(security): autofix Potential SQL injection via string-based query…
aikido-autofix[bot] Mar 27, 2026
ce814b6
fix: improve SQL injection guard error messages for neon-client
Mar 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions cli/templates/integrations/neon/files/lib/neon-client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,6 +251,12 @@ export async function getTableRowCount(
tableName: string,
schema: string = "public",
): Promise<number> {
if (!/^[a-zA-Z0-9_]+$/.test(schema)) {

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Allow quoted PostgreSQL identifiers in row-count lookup

The new allowlist ^[a-zA-Z0-9_]+$ is stricter than PostgreSQL identifier rules and rejects valid quoted schema/table names (for example names containing -, $, spaces, or non-ASCII characters). In this template, listTables() reads table names from pg_tables and those names are then passed into getTableRowCount(), so valid tables can now throw Invalid input and lose row counts in list-tables/describe-table despite being queryable. This is a functional regression introduced by the change.

Useful? React with 👍 / 👎.

throw new Error('Invalid schema name: must contain only letters, numbers, and underscores');
}
if (!/^[a-zA-Z0-9_]+$/.test(tableName)) {
throw new Error('Invalid table name: must contain only letters, numbers, and underscores');
}
const result = await query<{ count: string }>(
`SELECT COUNT(*) as count FROM "${schema}"."${tableName}"`,
);
Expand Down
Loading