kodev-org
/
vikunja
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(db): interpolate table identifiers in truncate instead of binding them 

MySQL/MariaDB/Postgres cannot bind a table name as a ? placeholder, so the non-SQLite branch failed with a syntax error. Interpolate the already-validated identifier with x.Quote (per-dialect quoting) instead. validateTableName restricts to registered table names, so this is injection-safe — the same trust model the SQLite branch already relies on. Latent bug surfaced by the new cross-engine testing webtest, which is the first to exercise this path on MySQL/MariaDB.
This commit is contained in:
kolaente 2026-06-17 13:55:50 +02:00 committed by kolaente
parent 4737114b12
commit 13f1a13367
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/db/dump.go
View File

@ -127,7 +127,7 @@ func RestoreAndTruncate(table string, contents []map[string]interface{}) (err er
return err
}
} else {
if _, err := x.Query("TRUNCATE TABLE ?", table); err != nil {
if _, err := x.Query("TRUNCATE TABLE " + x.Quote(table)); err != nil {
return err
}
}
@ -148,7 +148,7 @@ func TruncateAllTables() error {
return err
}
} else {
if _, err := x.Query("TRUNCATE TABLE ?", name); err != nil {
if _, err := x.Query("TRUNCATE TABLE " + x.Quote(name)); err != nil {
return err
}
}