fix: handle SQL comment side effects, fix injection risk and update query filtering

packages/pg-meta/src/sql/studio/role-impersonation.ts

@@ -27,7 +27,7 @@ function getCustomRoleImpersonationSql(roleName: string) {
 }
 
 // Includes getPostgrestRoleImpersonationSql() and wrapWithRoleImpersonation()
-export const ROLE_IMPERSONATION_SQL_LINE_COUNT = 11
+export const ROLE_IMPERSONATION_SQL_LINE_COUNT = 13
 export const ROLE_IMPERSONATION_NO_RESULTS = 'ROLE_IMPERSONATION_NO_RESULTS'
 
 export const getImpersonationSQL = ({

packages/pg-meta/src/sql/studio/sql-editor/ongoing-queries.ts

@@ -1,7 +1,5 @@
 export const getOngoingQueriesSql = () => {
   const sql = /* SQL */ `
--- source: dashboard
--- description: List currently active queries with PID, query text, and start time
 select pid, query, query_start from pg_stat_activity where state = 'active' and datname = 'postgres';
 `.trim()
 

packages/pg-meta/src/sql/studio/storage/delete-bucket-prefix.ts

@@ -1,3 +1,5 @@
+import { literal, safeSql } from '../../../pg-format'
+
 export const getDeleteBucketPrefixSQL = ({
   bucketId,
   prefix,
@@ -5,10 +7,11 @@ export const getDeleteBucketPrefixSQL = ({
   bucketId: string
   prefix: string
 }) => {
-  const sql = /* SQL */ `
--- source: dashboard
--- description: Delete all storage objects matching a prefix within a bucket
-select storage.delete_prefix('${bucketId}', '${prefix}');
-`.trim()
+  const sql = safeSql`
+    -- source: dashboard
+    -- description: Delete all storage objects matching a prefix within a bucket
+    select storage.delete_prefix(${literal(bucketId)}, ${literal(prefix)});
+  `
+
   return sql
-}
+}