Skip to content

fix: arcade db sql injection#3329

Merged
davidsbatista merged 3 commits into
mainfrom
fix/ArcadeDB-SQL-injection
May 19, 2026
Merged

fix: arcade db sql injection#3329
davidsbatista merged 3 commits into
mainfrom
fix/ArcadeDB-SQL-injection

Conversation

@davidsbatista
Copy link
Copy Markdown
Contributor

Related Issues

Proposed Changes:

  • Avoid field name injection with a regex
  • Backslash escaping in _sql_value

How did you test it?

  • unit tests

Checklist

@github-actions
Copy link
Copy Markdown
Contributor

Coverage report (arcadedb)

Click to see where and how coverage changed

FileStatementsMissingCoverageCoverage
(new stmts)
Lines missing
  integrations/arcadedb/src/haystack_integrations/document_stores/arcadedb
  filters.py
Project Total  

This report was generated by python-coverage-comment-action

@davidsbatista davidsbatista marked this pull request as ready for review May 19, 2026 10:23
@davidsbatista davidsbatista requested a review from a team as a code owner May 19, 2026 10:23
@davidsbatista davidsbatista requested review from julian-risch and removed request for a team May 19, 2026 10:23
Copy link
Copy Markdown
Member

@julian-risch julian-risch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks very good to me! Thanks for the quick work on this! 👍
Please do a new patch release once merged. Should be version 1.2.1

@julian-risch julian-risch changed the title Fix/arcade db sql injection fix: arcade db sql injection May 19, 2026
@davidsbatista davidsbatista merged commit a6ec44f into main May 19, 2026
12 checks passed
@davidsbatista davidsbatista deleted the fix/ArcadeDB-SQL-injection branch May 19, 2026 11:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants