Skip to content

Address sql injection duckdb#2278

Open
sundarshankar89 wants to merge 8 commits intofeature/typed-table-schemasfrom
address_sql_injection_duckdb
Open

Address sql injection duckdb#2278
sundarshankar89 wants to merge 8 commits intofeature/typed-table-schemasfrom
address_sql_injection_duckdb

Conversation

@sundarshankar89
Copy link
Collaborator

@sundarshankar89 sundarshankar89 commented Feb 10, 2026

Summary

Adds SQL injection protection for DuckDB table name.
Made design choice by limiting the name pattern in pipline config since this only expected to be used for information schema extracts.

  • Security
    • Added regex validation for step names to prevent SQL injection in DuckDB table identifiers
    • Validates step names must start with letter/underscore and contain only alphanumeric characters and underscores
    • Validates mode and type fields to ensure only recognized values are accepted
    • Validation occurs at config creation time (Step.post_init) to fail fast

Resolves #..

Functionality

  • added relevant user documentation
  • added new CLI command
  • modified existing command: databricks labs lakebridge ...
  • ... +add your own

Tests

  • manually tested
  • added unit tests
  • added integration tests

@codecov
Copy link

codecov bot commented Feb 10, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.15%. Comparing base (7f34625) to head (367194d).

Additional details and impacted files
@@                       Coverage Diff                       @@
##           feature/typed-table-schemas    #2278      +/-   ##
===============================================================
+ Coverage                        64.05%   64.15%   +0.09%     
===============================================================
  Files                               99       99              
  Lines                             8859     8880      +21     
  Branches                           920      925       +5     
===============================================================
+ Hits                              5675     5697      +22     
+ Misses                            3009     3008       -1     
  Partials                           175      175              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions
Copy link

github-actions bot commented Feb 10, 2026

✅ 133/133 passed, 7 flaky, 5 skipped, 10m28s total

Flaky tests:

  • 🤪 test_installs_and_runs_local_bladebridge (21.436s)
  • 🤪 test_installs_and_runs_pypi_bladebridge (31.058s)
  • 🤪 test_transpiles_informatica_to_sparksql (18.979s)
  • 🤪 test_transpile_teradata_sql (21.021s)
  • 🤪 test_transpiles_informatica_to_sparksql_non_interactive[False] (4.067s)
  • 🤪 test_transpile_teradata_sql_non_interactive[True] (5.845s)
  • 🤪 test_transpile_teradata_sql_non_interactive[False] (5.491s)

Running from acceptance #3688

@sundarshankar89 sundarshankar89 marked this pull request as ready for review February 10, 2026 13:39
@sundarshankar89 sundarshankar89 requested a review from a team as a code owner February 10, 2026 13:39
@sundarshankar89 sundarshankar89 added feat/profiler Issues related to profilers stacked PR Should be reviewed, but not merged labels Feb 10, 2026
@sundarshankar89 sundarshankar89 self-assigned this Feb 10, 2026
@sundarshankar89 sundarshankar89 added the internal technical pr's not end user facing label Feb 11, 2026
Copy link
Collaborator

@gueniai gueniai left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

feat/profiler Issues related to profilers internal technical pr's not end user facing stacked PR Should be reviewed, but not merged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants