influxdata / influxdata/influxdb
Support identifiers and other AST entities in influxql bind parameters
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
This is a feature request for InfluxDB 1.8.
At the moment, bind parameters are the way to avoid query injections when building queries using external data. For example, the following is _not_ safe, but is encouraged by the README for our client library: https://github.com/influxdata/influxdb/tree/1.7/client#querying-data
```
q := fmt.Sprintf("SELECT count(%s) FROM %s", "value", MyMeasurement)
```
This is because the bind parameters feature _only_ works for literals. It doesn't allow identifiers to be substituted in the AST.
The end purpose of this issue is to look through that readme and ensure that all queries that use `Sprintf` to be created can be similarly created with bind parameters.
Contributor guide
Research direction
Start with the InfluxDB 1.7 client README at client#querying-data and review the existing bind-parameter handling for InfluxQL literals. The work is done when the README's queries currently built with Sprintf can be safely expressed with bind parameters for identifiers and other AST entities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- databases
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100