AI-Cognitive-Leap/agnes-the-ai-analyst
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: escape single quotes in ATTACH TOKEN parameters

Browse source 
- In src/orchestrator.py _attach_remote_extensions: escape token with '' before passing to ATTACH
- In connectors/keboola/extractor.py _try_attach_extension: escape token with '' before passing to ATTACH

Prevents SQL injection if token contains single quotes.
This commit is contained in:
ZdenekSrotyr 2026-04-09 07:00:13 +02:00
parent 1b219cabe9
commit f25393871d
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
connectors/keboola/extractor.py
View file

@ -45,7 +45,8 @@ def _try_attach_extension(conn: duckdb.DuckDBPyConnection, keboola_url: str, keb
"""Try to install and attach the Keboola DuckDB extension. Returns True on success.""" """Try to install and attach the Keboola DuckDB extension. Returns True on success."""
try: try:
conn.execute("INSTALL keboola FROM community; LOAD keboola;") conn.execute("INSTALL keboola FROM community; LOAD keboola;")
conn.execute(f"ATTACH '{keboola_url}' AS kbc (TYPE keboola, TOKEN '{keboola_token}')") escaped_token = keboola_token.replace("'", "''")
conn.execute(f"ATTACH '{keboola_url}' AS kbc (TYPE keboola, TOKEN '{escaped_token}')")
logger.info("Using DuckDB Keboola extension") logger.info("Using DuckDB Keboola extension")
return True return True
except Exception as e: except Exception as e: