From 39f2203cec4bb4b0aa541710733fe7608e3d3c48 Mon Sep 17 00:00:00 2001 From: anch0r00 Date: Wed, 11 Mar 2026 15:24:44 +0800 Subject: [PATCH] fix: prevent SQL injection in uploadExcel via psycopg2.sql.Identifier --- backend/apps/datasource/api/datasource.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/backend/apps/datasource/api/datasource.py b/backend/apps/datasource/api/datasource.py index a731f003..da2041e8 100644 --- a/backend/apps/datasource/api/datasource.py +++ b/backend/apps/datasource/api/datasource.py @@ -5,6 +5,7 @@ import os import traceback import uuid from io import StringIO +from psycopg2 import sql from typing import List from urllib.parse import quote @@ -382,10 +383,10 @@ def insert_pg(df, tableName, engine): # output.seek(0) # pg copy - cursor.copy_expert( - sql=f"""COPY "{tableName}" FROM STDIN WITH CSV DELIMITER E'\t'""", - file=output + query = sql.SQL("COPY {} FROM STDIN WITH CSV DELIMITER E'\t'").format( + sql.Identifier(tableName) ) + cursor.copy_expert(sql=query.as_string(cursor.connection), file=output) conn.commit() except Exception as e: traceback.print_exc()