From dbeec9a1a5ecf3601c2d0357e4fdf3601cd4372e Mon Sep 17 00:00:00 2001
From: Monica Khoury <monica@supabase.io>
Date: Wed, 8 Apr 2026 17:44:42 +0300
Subject: [PATCH] fix: handle SQL comment side effects, fix injection risk and
 update query filtering

---
 .../pg-meta/src/sql/studio/role-impersonation.ts  |  2 +-
 .../src/sql/studio/sql-editor/ongoing-queries.ts  |  2 --
 .../sql/studio/storage/delete-bucket-prefix.ts    | 15 +++++++++------
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/packages/pg-meta/src/sql/studio/role-impersonation.ts b/packages/pg-meta/src/sql/studio/role-impersonation.ts
index 0954cbadc11..f29e4ee475d 100644
--- a/packages/pg-meta/src/sql/studio/role-impersonation.ts
+++ b/packages/pg-meta/src/sql/studio/role-impersonation.ts
@@ -27,7 +27,7 @@ function getCustomRoleImpersonationSql(roleName: string) {
 }
 
 // Includes getPostgrestRoleImpersonationSql() and wrapWithRoleImpersonation()
-export const ROLE_IMPERSONATION_SQL_LINE_COUNT = 11
+export const ROLE_IMPERSONATION_SQL_LINE_COUNT = 13
 export const ROLE_IMPERSONATION_NO_RESULTS = 'ROLE_IMPERSONATION_NO_RESULTS'
 
 export const getImpersonationSQL = ({
diff --git a/packages/pg-meta/src/sql/studio/sql-editor/ongoing-queries.ts b/packages/pg-meta/src/sql/studio/sql-editor/ongoing-queries.ts
index e0d0041358a..7fc0e22fc92 100644
--- a/packages/pg-meta/src/sql/studio/sql-editor/ongoing-queries.ts
+++ b/packages/pg-meta/src/sql/studio/sql-editor/ongoing-queries.ts
@@ -1,7 +1,5 @@
 export const getOngoingQueriesSql = () => {
   const sql = /* SQL */ `
--- source: dashboard
--- description: List currently active queries with PID, query text, and start time
 select pid, query, query_start from pg_stat_activity where state = 'active' and datname = 'postgres';
 `.trim()
 
diff --git a/packages/pg-meta/src/sql/studio/storage/delete-bucket-prefix.ts b/packages/pg-meta/src/sql/studio/storage/delete-bucket-prefix.ts
index da07e076dcf..0ffcdf42a09 100644
--- a/packages/pg-meta/src/sql/studio/storage/delete-bucket-prefix.ts
+++ b/packages/pg-meta/src/sql/studio/storage/delete-bucket-prefix.ts
@@ -1,3 +1,5 @@
+import { literal, safeSql } from '../../../pg-format'
+
 export const getDeleteBucketPrefixSQL = ({
   bucketId,
   prefix,
@@ -5,10 +7,11 @@ export const getDeleteBucketPrefixSQL = ({
   bucketId: string
   prefix: string
 }) => {
-  const sql = /* SQL */ `
--- source: dashboard
--- description: Delete all storage objects matching a prefix within a bucket
-select storage.delete_prefix('${bucketId}', '${prefix}');
-`.trim()
+  const sql = safeSql`
+    -- source: dashboard
+    -- description: Delete all storage objects matching a prefix within a bucket
+    select storage.delete_prefix(${literal(bucketId)}, ${literal(prefix)});
+  `
+
   return sql
-}
+}
\ No newline at end of file