T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/db.sh:400- Finding
Unsanitized Identifiers Allow Injection into Generated SQL
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi } ``` 2. Apply validation independently to: - `TABLE` - Every field name parsed from `FIELDS` - The field name parsed from `FIELD` - Every index field - User-supplied `INDEX_NAME` - Automatically generated index names 3. Reject rather than normalize identifiers containing quotes, backticks, semicolons, whitespace, SQL comments, newlines, control characters, or other punctuation. 4. Quote validated identifiers consistently for the selected database engine. Validation should remain mandatory even when quoting is used. 5. Add an engine-aware identifier helper, for example: ```bash quote_identifier() { local identifier="$1" validate_identifier "$identifier" if [[ "$ENGINE" == "postgres" ]]; then printf '"%s"' "$identifier" else printf '`%s`' "$identifier" fi } ``` 6. Do not emit custom index names as unquoted raw text. Validate and pass them through the same quoting helper used for other identifiers. 7. Add regression tests using hostile inputs containing: - Backticks and double quotes - Semicolons - `--` and `/* ... */` comments - Newlines and control characters - Spaces and shell metacharacters - Database reserved words 8. Clearly document that generated SQL must be reviewed before execution and should be applied using a least-privileged database account. This is defense in depth and must not replace validation. ]]>