mirror of
https://github.com/supabase/supabase.git
synced 2026-10-11 12:25:05 +03:00
Nedunchezhiyan-MandClaude Sonnet 4.6
6cca908e5b
## What Escapes user-controlled string values before interpolating them into SQL in `apps/studio/data/database-queues/`. ## Why Several queue message queries were constructing SQL via direct string interpolation without sanitization: | File | Value | Risk | |------|-------|------| | `database-queue-messages-send-mutation.ts` | `payload` | **High** — arbitrary user-provided JSON; a single quote breaks the query and a crafted payload could execute arbitrary SQL | | `database-queue-messages-infinite-query.ts` | `afterTimestamp` | Medium — sourced from a previous DB result, but still unsafe to interpolate | | `database-queue-messages-delete-mutation.ts` | `messageId` | Low — typed `number`, but truncated for safety | | `database-queue-messages-archive-mutation.ts` | `messageId` | Low — same as above | ## Fix - Escape string literals with the standard PostgreSQL approach (doubling single quotes `'` → `''`) before interpolation - Wrap numeric `messageId` values with `Math.trunc()` to prevent floating-point edge cases - `queueName` was already validated via `isQueueNameValid` regex (alphanumeric/underscore/hyphen only) — no change needed Fixes #44375 ## Test plan - [x] Open Queue Messages panel in Studio - [x] Send a message with a payload containing single quotes (e.g. `{"key": "it's a value"}`) — verify it sends without error - [x] Verify pagination still works correctly after fix <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved safety of queue operations by ensuring message IDs, payloads, timestamps, and queue names are handled securely to prevent injection and formatting issues. * Normalized numeric message fields (IDs/delays) for consistent processing. * Increased stability and correctness of archive, delete, query, and send operations; no public APIs were changed. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>