Skip to content

Commit e49cdb7

Browse files
sql query built from user controlled components security issue fix
1 parent 399c531 commit e49cdb7

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

App/kernel-memory/extensions/SQLServer/SQLServer/SqlServerMemory.cs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@
1212
using Microsoft.KernelMemory.MemoryStorage;
1313

1414
namespace Microsoft.KernelMemory.MemoryDb.SQLServer;
15+
// Accepts only [a-zA-Z_][a-zA-Z0-9_]{0,127}
16+
private static readonly Regex s_safeSqlIdentifierRegex = new Regex(@"^[a-zA-Z_][a-zA-Z0-9_]{0,127}$", RegexOptions.Compiled);
17+
1518

1619
/// <summary>
1720
/// Represents a memory store implementation that uses a SQL Server database as its backing store.
@@ -48,9 +51,6 @@ public sealed class SqlServerMemory : IMemoryDb, IMemoryDbUpsertBatch, IDisposab
4851
/// SQL Server version, retrieved on the first connection
4952
/// </summary>
5053
private int _cachedServerVersion = int.MinValue;
51-
// Accepts only [a-zA-Z_][a-zA-Z0-9_]{0,127}
52-
private static readonly Regex s_safeSqlIdentifierRegex = new Regex(@"^[a-zA-Z_][a-zA-Z0-9_]{0,127}$", RegexOptions.Compiled);
53-
5454

5555
/// <summary>
5656
/// Initializes a new instance of the <see cref="SqlServerMemory"/> class.

0 commit comments

Comments
 (0)