fix: use pg-format to allow dynamic identifier

Signed-off-by: Chris Langhout <clanghout@bol.com>

.changeset/sixty-kiwis-poke.md

@@ -2,4 +2,4 @@
 '@backstage/backend-defaults': patch
 ---
 
-use parameterized query to prevent chance of SQL-injection
+use formatted query to prevent chance of SQL-injection

packages/backend-defaults/package.json

@@ -171,6 +171,7 @@
     "path-to-regexp": "^6.2.1",
     "pg": "^8.11.3",
     "pg-connection-string": "^2.3.0",
+    "pg-format": "^1.0.4",
     "raw-body": "^2.4.1",
     "selfsigned": "^2.0.0",
     "stoppable": "^1.1.0",

packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts

@@ -29,6 +29,7 @@ import { Connector } from '../types';
 import defaultNameOverride from './defaultNameOverride';
 import defaultSchemaOverride from './defaultSchemaOverride';
 import { mergeDatabaseConfig } from './mergeDatabaseConfig';
+import { format } from 'pg-format';
 
 // Limits the number of concurrent DDL operations to 1
 const ddlLimiter = limiterFactory(1);
@@ -52,7 +53,8 @@ export function createPgDatabaseClient(
     database.client.pool.on(
       'createSuccess',
       async (_event: number, pgClient: Client) => {
-        await pgClient.query('SET ROLE $1', [role]);
+        const query = format('SET ROLE %I', role);
+        await pgClient.query(query);
       },
     );
   }

yarn.lock

@@ -3683,6 +3683,7 @@ __metadata:
     path-to-regexp: ^6.2.1
     pg: ^8.11.3
     pg-connection-string: ^2.3.0
+    pg-format: ^1.0.4
     raw-body: ^2.4.1
     selfsigned: ^2.0.0
     stoppable: ^1.1.0
@@ -36955,6 +36956,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"pg-format@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "pg-format@npm:1.0.4"
+  checksum: 159b43ad57d2f963f1072def86080dd2a6dd42c1a86046e388d47b491e00afe795139520eb01c8dffc43ac0243c77b3c4c5882d0ec5f488bb3281f17458b1b3d
+  languageName: node
+  linkType: hard
+
 "pg-int8@npm:1.0.1":
   version: 1.0.1
   resolution: "pg-int8@npm:1.0.1"