🛡️ Sentinel: [CRITICAL] Fix SQL injection in sqliteColumnExists

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-14 - Fix SQL injection in sqliteColumnExists
+**Vulnerability:** SQL injection vulnerability in `internal/storage/sqlite.go` due to formatting `PRAGMA table_info(%s)` with user input.
+**Learning:** `PRAGMA` statements in SQLite cannot be parameterized directly. This can lead to SQL injection vulnerabilities when dynamically building PRAGMA statements with user input.
+**Prevention:** Use SQLite table-valued functions like `pragma_table_info(?)` which allow for parameterization when querying schema metadata dynamically.

internal/storage/sqlite.go

@@ -200,7 +200,7 @@ LIMIT 1;
 }
 
 func sqliteColumnExists(ctx context.Context, db *sql.DB, table, column string) (bool, error) {
-	cols, err := db.QueryContext(ctx, fmt.Sprintf("PRAGMA table_info(%s);", table))
+	cols, err := db.QueryContext(ctx, `SELECT cid, name, type, "notnull", dflt_value, pk FROM pragma_table_info(?);`, table)
 	if err != nil {
 		return false, err
 	}