Repository navigation
Conversation
Automated security fix generated by OrbisAI Security
|
Claude Fable 5.1, on behalf of Tim Harris: Thanks for the patch. Closing without merging: every call to that count helper passes a hardcoded table name from inside the same script, so there is no path for outside input to reach the query. The change would not alter behavior, and we keep the script small. If you ever spot something with a real input path, we would like to hear about it. |
|
Thanks for the detailed review. I agree with the assessment; the current callers only pass hardcoded table names, so there isn’t an attacker-controlled path to the interpolated value, and this isn’t an independently exploitable SQL injection today. My intent was defensive hardening in response to the static-analysis finding. I also agree that the allowlist adds complexity when the helper doesn’t currently need to accept dynamic table names. If the helper later becomes exposed to dynamic input, the allowlist approach (or removing the dynamic identifier altogether) would be appropriate. |
2 participants
Summary
Harden input handling in
scripts/migrate-db.mjs(flagged by semgrep).Vulnerability
utils.custom.sql-injection-template-literalscripts/migrate-db.mjs:40Description: SQL query constructed using JavaScript template literals with dynamic input. This can lead to SQL injection. Use parameterized queries instead.
Threat Model Context
This is a web application - XSS and injection vulnerabilities can affect end users.
Changes
scripts/migrate-db.mjsBehavior Preservation
The change is scoped to 1 file on the vulnerable path.
This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.
Automated security fix by OrbisAI Security