Bremen
/
emma-hermes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7,155 Commits
2 Branches
0 Tags
303 MiB
Commit Graph

1 Commits (d6615d8ec7d5c5a3d7b63e3c2c4bfddbd6fddd4b)

Author SHA1 Message Date
Peppi Littera 219af75704 fix(security): eliminate SQL string formatting in execute() calls 
Closes #1911

- insights.py: Pre-compute SELECT queries as class constants instead of
  f-string interpolation at runtime. _SESSION_COLS is now evaluated once
  at class definition time.
- hermes_state.py: Add identifier quoting and whitelist validation for
  ALTER TABLE column names in schema migrations.
- Add 4 tests verifying no injection vectors in SQL query construction.
 2026-03-19 15:16:35 +01:00