Skip to content

Fix SQL injection vulnerability in Redshift fetch_table#5

Open
shaikjr wants to merge 2 commits into
harshitboots:mainfrom
shaikjr:feature/my-contribution
Open

Fix SQL injection vulnerability in Redshift fetch_table#5
shaikjr wants to merge 2 commits into
harshitboots:mainfrom
shaikjr:feature/my-contribution

Conversation

@shaikjr

@shaikjr shaikjr commented Jun 12, 2026

Copy link
Copy Markdown

The fetch_table function used an f-string to build the SQL query, allowing the table name to be injected directly into the query. This fixes it by using psycopg2.sql.Identifier for safe identifier composition and parameterized queries for the LIMIT value. Also added a basic validation check on the table name.

Also removed two stray Windows Zone.Identifier files that were accidentally tracked.

@harshitboots

Copy link
Copy Markdown
Owner

Nice security improvement overall switching from f-string SQL to psycopg2.sql.Identifier + parameterized LIMIT is the right fix.
One concern: the new table.replace('_', '').isalnum() validation may reject valid Redshift/Postgres table references like public.users. Since sql.Identifier already handles safe escaping, can we either remove that validation or update it to support schema-qualified names safely?

@shaikjr

shaikjr commented Jun 18, 2026

Copy link
Copy Markdown
Author

Good catch the validation was overly restrictive for schema-qualified names. Since psycopg2.sql.Identifier already safely handles identifier escaping, I’ll remove the custom validation to avoid blocking valid table references like public.users.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants