DuckDB: Parameterize DateTime values in ArchiveService queries

[erikdarlingdata]

Source

Static security assessment (#840, finding S-3 — P1)

Problem

DateTime values are string-interpolated into DuckDB WHERE clauses instead of using parameterized queries.

Locations:

• Lite/Services/ArchiveService.cs:136 — GetRowCountBeforeCutoff
• Lite/Services/ArchiveService.cs:164 — count query
• Lite/Services/ArchiveService.cs:174 — export COPY query

Example

cmd.CommandText = $"SELECT COUNT(*) FROM {table} WHERE {timeColumn} < '{cutoff:yyyy-MM-dd HH:mm:ss}'";

Fix

Use DuckDB parameters ($1, $2) for the cutoff values:

cmd.CommandText = $"SELECT COUNT(*) FROM {table} WHERE {timeColumn} < $1";
cmd.Parameters.Add(new DuckDBParameter { Value = cutoff });

Table/column names can't be parameterized but come from the hardcoded ArchivableTables list, so those are safe.