emma-hermes

Commit Graph

Author	SHA1	Message	Date
Peppi Littera	219af75704	fix(security): eliminate SQL string formatting in execute() calls Closes #1911 - insights.py: Pre-compute SELECT queries as class constants instead of f-string interpolation at runtime. _SESSION_COLS is now evaluated once at class definition time. - hermes_state.py: Add identifier quoting and whitelist validation for ALTER TABLE column names in schema migrations. - Add 4 tests verifying no injection vectors in SQL query construction.	2026-03-19 15:16:35 +01:00

Author

SHA1

Message

Date

Peppi Littera

219af75704

fix(security): eliminate SQL string formatting in execute() calls

Closes #1911

- insights.py: Pre-compute SELECT queries as class constants instead of
  f-string interpolation at runtime. _SESSION_COLS is now evaluated once
  at class definition time.
- hermes_state.py: Add identifier quoting and whitelist validation for
  ALTER TABLE column names in schema migrations.
- Add 4 tests verifying no injection vectors in SQL query construction.

2026-03-19 15:16:35 +01:00

1 Commits (4979d77a4a908650df15a181d00a921680d5110a)