typelevel / typelevel/skunk

SQL injection in Channel.fromNameAndProtocol

Open
#1,339 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.7k
Forks
175
Avg merge
5d 14h
Merged PRs (30d)
9

Description

Here it is. It's already marked with a TODO comment, but this definitely deserves an issue.

The obvious way is to build a Command[String] using interpolation and work with that. However, that would require we prepare the statement before execution, which, I assume, is slower that what we have now. The alternative is manually escaping the string.

UPD: Interpolation doesn't seem possible, unless we move macros to a separate compilation unit. It's possible to do that without affecting resulting artifacts, but for this issue it's enough to just manually write out a Command with a placeholder.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at modules/core/shared/src/main/scala/Channel.scala#L145 and read the TODO and surrounding fromNameAndProtocol implementation. Trace how the command is built and check the available Command API; done means this entry point no longer permits SQL injection while preserving its existing behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgres, scala
Domain
databases, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.