Skip to content

Commit 9eb021c

Browse files
Revert "code QL issues fix in progressdbclient.cs file inside kernal memory floder"
This reverts commit 4230c30.
1 parent 4230c30 commit 9eb021c

File tree

2 files changed

+10
-13
lines changed

2 files changed

+10
-13
lines changed

App/kernel-memory/extensions/Postgres/Postgres/Internals/PostgresDbClient.cs

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -315,8 +315,7 @@ public async Task DeleteTableAsync(
315315
await using (cmd.ConfigureAwait(false))
316316
{
317317
#pragma warning disable CA2100 // SQL reviewed
318-
// Escape and quote the table name to prevent SQL injection. This expects previous normalization/validation.
319-
cmd.CommandText = $"DROP TABLE IF EXISTS {EscapeIdentifierForPostgres(tableName)}";
318+
cmd.CommandText = $"DROP TABLE IF EXISTS {tableName}";
320319
#pragma warning restore CA2100
321320

322321
this._log.LogTrace("Deleting table. SQL: {0}", cmd.CommandText);
@@ -779,13 +778,4 @@ private static long GenLockId(string resourceId)
779778
return BitConverter.ToUInt32(SHA256.HashData(Encoding.UTF8.GetBytes(resourceId)), 0)
780779
% short.MaxValue;
781780
}
782-
/// <summary>
783-
/// Escape a SQL identifier (such as table or schema name) for use in Postgres queries.
784-
/// Assumes the identifier is already validated.
785-
/// </summary>
786-
private static string EscapeIdentifierForPostgres(string identifier)
787-
{
788-
// Double quotes in identifiers are escaped by doubling them in PostgreSQL
789-
return $"\"{identifier.Replace("\"", "\"\"")}\"";
790-
}
791781
}

App/kernel-memory/extensions/Postgres/Postgres/PostgresMemory.cs

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -232,11 +232,18 @@ private void Dispose(bool disposing)
232232
// Note: "_" is allowed in Postgres, but we normalize it to "-" for consistency with other DBs
233233
private static readonly Regex s_replaceIndexNameCharsRegex = new(@"[\s|\\|/|.|_|:]");
234234
private const string ValidSeparator = "-";
235-
235+
// Only allow 1-63 chars, start with a lowercase letter, then letters, digits, dashes, or underscores.
236+
private static readonly Regex s_validIndexNameRegex = new(@"^[a-z][a-z0-9\-_]{0,62}$", RegexOptions.Compiled);
237+
236238
private static string NormalizeIndexName(string index)
237239
{
238240
ArgumentNullExceptionEx.ThrowIfNullOrWhiteSpace(index, nameof(index), "The index name is empty");
239-
index = s_replaceIndexNameCharsRegex.Replace(index.Trim().ToLowerInvariant(), ValidSeparator);
241+
index = s_replaceIndexNameCharsRegex.Replace(index.Trim().ToLowerInvariant(), ValidSeparator);
242+
// Enforce positive validation for safe Postgres identifier.
243+
if (!s_validIndexNameRegex.IsMatch(index))
244+
{
245+
throw new ArgumentException($"Index name '{index}' is invalid. Must match regex: ^[a-z][a-z0-9\\-_]{{0,62}}$");
246+
}
240247

241248
PostgresSchema.ValidateTableName(index);
242249

0 commit comments

Comments
 (0)