Skip to content

Security: Fix SQL injection vulnerabilities in PostgreSQL storage#2235

Merged
danielaskdd merged 1 commit intoHKUDS:mainfrom
lucky-verma:security/fix-sql-injection-postgres
Oct 18, 2025
Merged

Security: Fix SQL injection vulnerabilities in PostgreSQL storage#2235
danielaskdd merged 1 commit intoHKUDS:mainfrom
lucky-verma:security/fix-sql-injection-postgres

Conversation

@lucky-verma
Copy link
Contributor

  • Replace string interpolation with parameterized queries using ANY($n)
  • Update get_by_ids to use secure parameter binding
  • Fix filter_keys methods in KVStorage and VectorDBStorage
  • Add explicit whitelist validation in get_docs_paginated
  • Resolves 5 high-severity SQL injection vulnerabilities

@danielaskdd
Copy link
Collaborator

@codex review

@chatgpt-codex-connector
Copy link

Codex Review: Didn't find any major issues. Keep them coming!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@danielaskdd danielaskdd merged commit 917e41a into HKUDS:main Oct 18, 2025
1 check failed
@danielaskdd
Copy link
Collaborator

Thanks for sharing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants