From 8f1500e118a75ae40c0fec1802d19a787dcf5fd5 Mon Sep 17 00:00:00 2001 From: Chris Langhout Date: Thu, 4 Jul 2024 11:16:40 +0200 Subject: [PATCH 1/5] fix: use parameterized query Signed-off-by: Chris Langhout --- .../src/entrypoints/database/connectors/postgres.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts b/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts index 444bbc0d18..7d9d943fc7 100644 --- a/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts +++ b/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts @@ -52,7 +52,7 @@ export function createPgDatabaseClient( database.client.pool.on( 'createSuccess', async (_event: number, pgClient: Client) => { - await pgClient.query(`SET ROLE ${role}`); + await pgClient.query('SET ROLE $1', [role]); }, ); } From 81f930aeed19074adb914c59486b2519e52ec091 Mon Sep 17 00:00:00 2001 From: Chris Langhout Date: Thu, 4 Jul 2024 11:51:58 +0200 Subject: [PATCH 2/5] chore: add changeset Signed-off-by: Chris Langhout --- .changeset/sixty-kiwis-poke.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/sixty-kiwis-poke.md diff --git a/.changeset/sixty-kiwis-poke.md b/.changeset/sixty-kiwis-poke.md new file mode 100644 index 0000000000..d4380cbd88 --- /dev/null +++ b/.changeset/sixty-kiwis-poke.md @@ -0,0 +1,5 @@ +--- +'@backstage/backend-defaults': patch +--- + +use parameterized query to prevent chance of SQL-injection From ed83fcc3e7b94d0d955a093ed48a173ad4c9588a Mon Sep 17 00:00:00 2001 From: Chris Langhout Date: Tue, 6 Aug 2024 15:11:28 +0200 Subject: [PATCH 3/5] fix: use pg-format to allow dynamic identifier Signed-off-by: Chris Langhout --- .changeset/sixty-kiwis-poke.md | 2 +- packages/backend-defaults/package.json | 1 + .../src/entrypoints/database/connectors/postgres.ts | 4 +++- yarn.lock | 8 ++++++++ 4 files changed, 13 insertions(+), 2 deletions(-) diff --git a/.changeset/sixty-kiwis-poke.md b/.changeset/sixty-kiwis-poke.md index d4380cbd88..5281c6ade0 100644 --- a/.changeset/sixty-kiwis-poke.md +++ b/.changeset/sixty-kiwis-poke.md @@ -2,4 +2,4 @@ '@backstage/backend-defaults': patch --- -use parameterized query to prevent chance of SQL-injection +use formatted query to prevent chance of SQL-injection diff --git a/packages/backend-defaults/package.json b/packages/backend-defaults/package.json index 196c9b188a..3341c96c75 100644 --- a/packages/backend-defaults/package.json +++ b/packages/backend-defaults/package.json @@ -171,6 +171,7 @@ "path-to-regexp": "^6.2.1", "pg": "^8.11.3", "pg-connection-string": "^2.3.0", + "pg-format": "^1.0.4", "raw-body": "^2.4.1", "selfsigned": "^2.0.0", "stoppable": "^1.1.0", diff --git a/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts b/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts index 7d9d943fc7..afaa946c05 100644 --- a/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts +++ b/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts @@ -29,6 +29,7 @@ import { Connector } from '../types'; import defaultNameOverride from './defaultNameOverride'; import defaultSchemaOverride from './defaultSchemaOverride'; import { mergeDatabaseConfig } from './mergeDatabaseConfig'; +import { format } from 'pg-format'; // Limits the number of concurrent DDL operations to 1 const ddlLimiter = limiterFactory(1); @@ -52,7 +53,8 @@ export function createPgDatabaseClient( database.client.pool.on( 'createSuccess', async (_event: number, pgClient: Client) => { - await pgClient.query('SET ROLE $1', [role]); + const query = format('SET ROLE %I', role); + await pgClient.query(query); }, ); } diff --git a/yarn.lock b/yarn.lock index c14251269c..75552e383b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3683,6 +3683,7 @@ __metadata: path-to-regexp: ^6.2.1 pg: ^8.11.3 pg-connection-string: ^2.3.0 + pg-format: ^1.0.4 raw-body: ^2.4.1 selfsigned: ^2.0.0 stoppable: ^1.1.0 @@ -36955,6 +36956,13 @@ __metadata: languageName: node linkType: hard +"pg-format@npm:^1.0.4": + version: 1.0.4 + resolution: "pg-format@npm:1.0.4" + checksum: 159b43ad57d2f963f1072def86080dd2a6dd42c1a86046e388d47b491e00afe795139520eb01c8dffc43ac0243c77b3c4c5882d0ec5f488bb3281f17458b1b3d + languageName: node + linkType: hard + "pg-int8@npm:1.0.1": version: 1.0.1 resolution: "pg-int8@npm:1.0.1" From 67f3a3932f857d5bf20b93e6fc3fb01c5adeb5b6 Mon Sep 17 00:00:00 2001 From: Chris Langhout Date: Tue, 6 Aug 2024 18:09:27 +0200 Subject: [PATCH 4/5] fix: add type dep Signed-off-by: Chris Langhout --- packages/backend-defaults/package.json | 1 + .../src/entrypoints/database/connectors/postgres.ts | 2 +- yarn.lock | 8 ++++++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/packages/backend-defaults/package.json b/packages/backend-defaults/package.json index 3341c96c75..38d703e2b4 100644 --- a/packages/backend-defaults/package.json +++ b/packages/backend-defaults/package.json @@ -141,6 +141,7 @@ "@opentelemetry/api": "^1.3.0", "@types/cors": "^2.8.6", "@types/express": "^4.17.6", + "@types/pg-format": "^1.0.5", "archiver": "^6.0.0", "base64-stream": "^1.0.0", "better-sqlite3": "^11.0.0", diff --git a/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts b/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts index afaa946c05..46b958789d 100644 --- a/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts +++ b/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts @@ -29,7 +29,7 @@ import { Connector } from '../types'; import defaultNameOverride from './defaultNameOverride'; import defaultSchemaOverride from './defaultSchemaOverride'; import { mergeDatabaseConfig } from './mergeDatabaseConfig'; -import { format } from 'pg-format'; +import format from 'pg-format'; // Limits the number of concurrent DDL operations to 1 const ddlLimiter = limiterFactory(1); diff --git a/yarn.lock b/yarn.lock index 75552e383b..2da7805693 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3649,6 +3649,7 @@ __metadata: "@types/http-errors": ^2.0.0 "@types/morgan": ^1.9.0 "@types/node-forge": ^1.3.0 + "@types/pg-format": ^1.0.5 "@types/stoppable": ^1.1.0 archiver: ^6.0.0 aws-sdk-client-mock: ^4.0.0 @@ -18593,6 +18594,13 @@ __metadata: languageName: node linkType: hard +"@types/pg-format@npm:^1.0.5": + version: 1.0.5 + resolution: "@types/pg-format@npm:1.0.5" + checksum: e7907b1e478b54aec581d14bc4df349d40d6e30e1f03605e9d162f515f35064e9deaeeb563cb812adfac271522c7ed68b13ebb6e2036d557c5533cf6357419bd + languageName: node + linkType: hard + "@types/pg-pool@npm:2.0.4": version: 2.0.4 resolution: "@types/pg-pool@npm:2.0.4" From aa5149806e3583b67f166dd36ba6fa472bcec4ed Mon Sep 17 00:00:00 2001 From: Chris Langhout Date: Wed, 7 Aug 2024 12:29:16 +0200 Subject: [PATCH 5/5] fix: move @types deps to dev-dependencies Signed-off-by: Chris Langhout --- packages/backend-defaults/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/backend-defaults/package.json b/packages/backend-defaults/package.json index 38d703e2b4..4ac9a759c0 100644 --- a/packages/backend-defaults/package.json +++ b/packages/backend-defaults/package.json @@ -141,7 +141,6 @@ "@opentelemetry/api": "^1.3.0", "@types/cors": "^2.8.6", "@types/express": "^4.17.6", - "@types/pg-format": "^1.0.5", "archiver": "^6.0.0", "base64-stream": "^1.0.0", "better-sqlite3": "^11.0.0", @@ -193,6 +192,7 @@ "@types/http-errors": "^2.0.0", "@types/morgan": "^1.9.0", "@types/node-forge": "^1.3.0", + "@types/pg-format": "^1.0.5", "@types/stoppable": "^1.1.0", "aws-sdk-client-mock": "^4.0.0", "http-errors": "^2.0.0",