From ed83fcc3e7b94d0d955a093ed48a173ad4c9588a Mon Sep 17 00:00:00 2001
From: Chris Langhout <clanghout@bol.com>
Date: Tue, 6 Aug 2024 15:11:28 +0200
Subject: [PATCH] fix: use pg-format to allow dynamic identifier

Signed-off-by: Chris Langhout <clanghout@bol.com>
---
 .changeset/sixty-kiwis-poke.md                            | 2 +-
 packages/backend-defaults/package.json                    | 1 +
 .../src/entrypoints/database/connectors/postgres.ts       | 4 +++-
 yarn.lock                                                 | 8 ++++++++
 4 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.changeset/sixty-kiwis-poke.md b/.changeset/sixty-kiwis-poke.md
index d4380cbd88..5281c6ade0 100644
--- a/.changeset/sixty-kiwis-poke.md
+++ b/.changeset/sixty-kiwis-poke.md
@@ -2,4 +2,4 @@
 '@backstage/backend-defaults': patch
 ---
 
-use parameterized query to prevent chance of SQL-injection
+use formatted query to prevent chance of SQL-injection
diff --git a/packages/backend-defaults/package.json b/packages/backend-defaults/package.json
index 196c9b188a..3341c96c75 100644
--- a/packages/backend-defaults/package.json
+++ b/packages/backend-defaults/package.json
@@ -171,6 +171,7 @@
     "path-to-regexp": "^6.2.1",
     "pg": "^8.11.3",
     "pg-connection-string": "^2.3.0",
+    "pg-format": "^1.0.4",
     "raw-body": "^2.4.1",
     "selfsigned": "^2.0.0",
     "stoppable": "^1.1.0",
diff --git a/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts b/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts
index 7d9d943fc7..afaa946c05 100644
--- a/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts
+++ b/packages/backend-defaults/src/entrypoints/database/connectors/postgres.ts
@@ -29,6 +29,7 @@ import { Connector } from '../types';
 import defaultNameOverride from './defaultNameOverride';
 import defaultSchemaOverride from './defaultSchemaOverride';
 import { mergeDatabaseConfig } from './mergeDatabaseConfig';
+import { format } from 'pg-format';
 
 // Limits the number of concurrent DDL operations to 1
 const ddlLimiter = limiterFactory(1);
@@ -52,7 +53,8 @@ export function createPgDatabaseClient(
     database.client.pool.on(
       'createSuccess',
       async (_event: number, pgClient: Client) => {
-        await pgClient.query('SET ROLE $1', [role]);
+        const query = format('SET ROLE %I', role);
+        await pgClient.query(query);
       },
     );
   }
diff --git a/yarn.lock b/yarn.lock
index c14251269c..75552e383b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3683,6 +3683,7 @@ __metadata:
     path-to-regexp: ^6.2.1
     pg: ^8.11.3
     pg-connection-string: ^2.3.0
+    pg-format: ^1.0.4
     raw-body: ^2.4.1
     selfsigned: ^2.0.0
     stoppable: ^1.1.0
@@ -36955,6 +36956,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"pg-format@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "pg-format@npm:1.0.4"
+  checksum: 159b43ad57d2f963f1072def86080dd2a6dd42c1a86046e388d47b491e00afe795139520eb01c8dffc43ac0243c77b3c4c5882d0ec5f488bb3281f17458b1b3d
+  languageName: node
+  linkType: hard
+
 "pg-int8@npm:1.0.1":
   version: 1.0.1
   resolution: "pg-int8@npm:1.0.1"