Skip to content

🛡️ Sentinel: [CRITICAL] Fix SQL Injection in sqliteColumnExists #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mattjoyce wants to merge 1 commit into from
+5 −1
Closed

🛡️ Sentinel: [CRITICAL] Fix SQL Injection in sqliteColumnExists #96

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2026-05-24 - [SQL Injection via String Formatting in PRAGMA table_info]
**Vulnerability:** Found a SQL injection risk in `internal/storage/sqlite.go` where `fmt.Sprintf("PRAGMA table_info(%s);", table)` was used to dynamically construct a schema inspection query.
Comment on lines +1 to +2
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix heading level and blank-line spacing to satisfy markdownlint.

Line 1 should be a top-level heading, and it should be followed by a blank line before the paragraph text.

Suggested diff 
-## 2026-05-24 - [SQL Injection via String Formatting in PRAGMA table_info]
+# 2026-05-24 - [SQL Injection via String Formatting in PRAGMA table_info]
+
 **Vulnerability:** Found a SQL injection risk in `internal/storage/sqlite.go` where `fmt.Sprintf("PRAGMA table_info(%s);", table)` was used to dynamically construct a schema inspection query.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
## 2026-05-24 - [SQL Injection via String Formatting in PRAGMA table_info]
**Vulnerability:** Found a SQL injection risk in `internal/storage/sqlite.go` where `fmt.Sprintf("PRAGMA table_info(%s);", table)` was used to dynamically construct a schema inspection query.
# 2026-05-24 - [SQL Injection via String Formatting in PRAGMA table_info]
**Vulnerability:** Found a SQL injection risk in `internal/storage/sqlite.go` where `fmt.Sprintf("PRAGMA table_info(%s);", table)` was used to dynamically construct a schema inspection query.
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)

[warning] 1-1: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below

(MD022, blanks-around-headings)

[warning] 1-1: First line in a file should be a top-level heading

(MD041, first-line-heading, first-line-h1)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.jules/sentinel.md around lines 1 - 2, Change the first line to a top-level
heading and add a blank line after it: update the heading "2026-05-24 - [SQL
Injection via String Formatting in PRAGMA table_info]" to be a H1 (prefix with a
single "#") and ensure there is an empty line between that heading and the
following paragraph so the file conforms to markdownlint rules.

**Learning:** SQLite `PRAGMA` statements historically do not support parameterization. This led to using string concatenation or `fmt.Sprintf` to build the query dynamically.
**Prevention:** Use SQLite's parameterizable table-valued functions instead. For `PRAGMA table_info`, the equivalent parameterized query is `SELECT cid, name, type, "notnull", dflt_value, pk FROM pragma_table_info(?)`. Ensure to double quote `"notnull"` as it's a reserved keyword.
2 changes: 1 addition & 1 deletion internal/storage/sqlite.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,7 +200,7 @@ LIMIT 1;
}

func sqliteColumnExists(ctx context.Context, db *sql.DB, table, column string) (bool, error) {
cols, err := db.QueryContext(ctx, fmt.Sprintf("PRAGMA table_info(%s);", table))
cols, err := db.QueryContext(ctx, `SELECT cid, name, type, "notnull", dflt_value, pk FROM pragma_table_info(?)`, table)
if err != nil {
return false, err
}
Expand Down
Loading