Merge pull request #25521 from clanghout/patch-2

fix: use parameterized query

.changeset/sixty-kiwis-poke.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+use formatted query to prevent chance of SQL-injection

packages/backend-defaults/package.json

@@ -171,6 +171,7 @@
     "path-to-regexp": "^6.2.1",
     "pg": "^8.11.3",
     "pg-connection-string": "^2.3.0",
+    "pg-format": "^1.0.4",
     "raw-body": "^2.4.1",
     "selfsigned": "^2.0.0",
     "stoppable": "^1.1.0",
@@ -191,6 +192,7 @@
     "@types/http-errors": "^2.0.0",
     "@types/morgan": "^1.9.0",
     "@types/node-forge": "^1.3.0",
+    "@types/pg-format": "^1.0.5",
     "@types/stoppable": "^1.1.0",
     "aws-sdk-client-mock": "^4.0.0",
     "http-errors": "^2.0.0",

packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts

@@ -29,6 +29,7 @@ import { Connector } from '../types';
 import defaultNameOverride from './defaultNameOverride';
 import defaultSchemaOverride from './defaultSchemaOverride';
 import { mergeDatabaseConfig } from './mergeDatabaseConfig';
+import format from 'pg-format';
 
 // Limits the number of concurrent DDL operations to 1
 const ddlLimiter = limiterFactory(1);
@@ -52,7 +53,8 @@ export function createPgDatabaseClient(
     database.client.pool.on(
       'createSuccess',
       async (_event: number, pgClient: Client) => {
-        await pgClient.query(`SET ROLE ${role}`);
+        const query = format('SET ROLE %I', role);
+        await pgClient.query(query);
       },
     );
   }

yarn.lock

@@ -3649,6 +3649,7 @@ __metadata:
     "@types/http-errors": ^2.0.0
     "@types/morgan": ^1.9.0
     "@types/node-forge": ^1.3.0
+    "@types/pg-format": ^1.0.5
     "@types/stoppable": ^1.1.0
     archiver: ^6.0.0
     aws-sdk-client-mock: ^4.0.0
@@ -3683,6 +3684,7 @@ __metadata:
     path-to-regexp: ^6.2.1
     pg: ^8.11.3
     pg-connection-string: ^2.3.0
+    pg-format: ^1.0.4
     raw-body: ^2.4.1
     selfsigned: ^2.0.0
     stoppable: ^1.1.0
@@ -18620,6 +18622,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/pg-format@npm:^1.0.5":
+  version: 1.0.5
+  resolution: "@types/pg-format@npm:1.0.5"
+  checksum: e7907b1e478b54aec581d14bc4df349d40d6e30e1f03605e9d162f515f35064e9deaeeb563cb812adfac271522c7ed68b13ebb6e2036d557c5533cf6357419bd
+  languageName: node
+  linkType: hard
+
 "@types/pg-pool@npm:2.0.4":
   version: 2.0.4
   resolution: "@types/pg-pool@npm:2.0.4"
@@ -36984,6 +36993,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"pg-format@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "pg-format@npm:1.0.4"
+  checksum: 159b43ad57d2f963f1072def86080dd2a6dd42c1a86046e388d47b491e00afe795139520eb01c8dffc43ac0243c77b3c4c5882d0ec5f488bb3281f17458b1b3d
+  languageName: node
+  linkType: hard
+
 "pg-int8@npm:1.0.1":
   version: 1.0.1
   resolution: "pg-int8@npm:1.0.1"