🛡️ Sentinel: [CRITICAL] Fix SQL injection in internal/storage/sqlite.go

.jules/sentinel.md

@@ -0,0 +1,5 @@
+
+## 2024-05-19 - SQL Injection in PRAGMA table_info
+**Vulnerability:** SQL injection via unparameterized string concatenation in PRAGMA table_info queries.
+**Learning:** SQLite's PRAGMA statements cannot be directly parameterized. However, modern SQLite provides table-valued functions like `pragma_table_info(?)` which allow for safe parameterized queries. The "notnull" column must be quoted since it's a reserved keyword.
+**Prevention:** Always use table-valued functions (`pragma_*()`) instead of PRAGMA statements when checking schema metadata to ensure user input can be safely parameterized.

internal/storage/sqlite.go

@@ -200,7 +200,7 @@ LIMIT 1;
 }
 
 func sqliteColumnExists(ctx context.Context, db *sql.DB, table, column string) (bool, error) {
-	cols, err := db.QueryContext(ctx, fmt.Sprintf("PRAGMA table_info(%s);", table))
+	cols, err := db.QueryContext(ctx, "SELECT cid, name, type, \"notnull\", dflt_value, pk FROM pragma_table_info(?);", table)
 	if err != nil {
 		return false, err
 	}