chore: fix sql query

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Jiyong Huang <huangjy@emqx.io>

internal/pkg/store/sql/database.go

@@ -1,4 +1,4 @@
-// Copyright 2022-2022 EMQ Technologies Co., Ltd.
+// Copyright 2022-2024 EMQ Technologies Co., Ltd.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -14,8 +14,31 @@
 
 package sql
 
-import "database/sql"
+import (
+	"database/sql"
+	"regexp"
+)
 
 type Database interface {
 	Apply(f func(db *sql.DB) error) error
 }
+
+// isValidTableName checks if the given string is a valid database table name.
+func isValidTableName(tableName string) bool {
+	// Check if the table name is empty
+	if tableName == "" {
+		return false
+	}
+
+	// Regular expression to match valid table names
+	// ^[a-zA-Z_][a-zA-Z0-9_]*$
+	// ^[a-zA-Z_] ensures the name starts with a letter or underscore
+	// [a-zA-Z0-9_]*$ ensures the rest of the name consists of letters, digits, or underscores
+	validTableNamePattern := `^[a-zA-Z_][a-zA-Z0-9_]*$`
+
+	// Compile the regular expression
+	re := regexp.MustCompile(validTableNamePattern)
+
+	// Check if the table name matches the pattern
+	return re.MatchString(tableName)
+}

internal/pkg/store/sql/sqlKv.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 EMQ Technologies Co., Ltd.
+// Copyright 2021-2024 EMQ Technologies Co., Ltd.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -31,6 +31,9 @@ type sqlKvStore struct {
 }
 
 func createSqlKvStore(database Database, table string) (*sqlKvStore, error) {
+	if !isValidTableName(table) {
+		return nil, fmt.Errorf("invalid table name: %s", table)
+	}
 	store := &sqlKvStore{
 		database: database,
 		table:    table,
@@ -157,12 +160,12 @@ func (kv *sqlKvStore) Delete(key string) error {
 		if nil != err || 0 == len(tmp) {
 			return errorx.NewWithCode(errorx.NOT_FOUND, fmt.Sprintf("%s is not found", key))
 		}
-		query = fmt.Sprintf("DELETE FROM '%s' WHERE key='%s';", kv.table, key)
+		query = fmt.Sprintf("DELETE FROM '%s' WHERE key=?;", kv.table)
 		stmt, err = db.Prepare(query)
 		if err != nil {
 			return err
 		}
-		_, err = stmt.Exec()
+		_, err = stmt.Exec(key)
 		return err
 	})
 }

internal/pkg/store/sql/sqlTs.go

@@ -1,4 +1,4 @@
-// Copyright 2022-2023 EMQ Technologies Co., Ltd.
+// Copyright 2022-2024 EMQ Technologies Co., Ltd.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -30,6 +30,9 @@ type ts struct {
 }
 
 func createSqlTs(database Database, table string) (*ts, error) {
+	if !isValidTableName(table) {
+		return nil, fmt.Errorf("invalid table name: %s", table)
+	}
 	store := &ts{
 		database: database,
 		table:    table,