feat(teradata): enhance column extraction with prepared statement fallback#16246
feat(teradata): enhance column extraction with prepared statement fallback#16246brock-acryl wants to merge 1 commit intomasterfrom
Conversation
| # Quote identifiers to prevent SQL injection | ||
| escaped_schema = schema.replace('"', '""') | ||
| escaped_table = table_name.replace('"', '""') | ||
| query_str = f'SELECT * FROM "{escaped_schema}"."{escaped_table}" WHERE 1=0' |
There was a problem hiding this comment.
Potential SQL injection via string-based query concatenation - critical severity
SQL injection might be possible in these locations, especially if the strings being concatenated are controlled via user input.
Remediation: If possible, rebuild the query to use prepared statements or an ORM. If that is not possible, make sure the user input is verified or sanitized. As an added layer of protection, we also recommend installing a WAF that blocks SQL injection attacks.
View details in Aikido Security
❌ 1 Tests Failed:
View the top 1 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
|
✅ Meticulous spotted 0 visual differences across 1009 screens tested: view results. Meticulous evaluated ~8 hours of user flows against your PR. Expected differences? Click here. Last updated for commit c7ba25b. This comment will update as new commits are pushed. |
Bundle ReportBundle size has no change ✅ |
Fallback for column metadata: when column metadata cannot be obtained via QVCI (views), DBC system tables, or HELP COLUMN, ingestion can use prepared statements to extract column datatypes for both tables and views (when use_prepared_statement_metadata or metadata_extraction_fallback is enabled).