Skip to content

fix: block SQL injection in role attributes #436

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
moizpgedge merged 3 commits into from
Jul 21, 2026
Merged

fix: block SQL injection in role attributes #436

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
05f074d
fix: prevent SQL injection via role attributes (PLAT-685)
moizpgedge Jul 17, 2026
8dd6814
security fix
moizpgedge Jul 18, 2026
876e3a1
ci build issue
moizpgedge Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion .trivy/pgedge-control-plane.trivyignore.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,12 @@ vulnerabilities:
- id: CVE-2026-33997
statement: "Docker daemon plugin privilege validation — not applicable, no Docker plugins used"
- id: CVE-2025-54410
statement: "Docker daemon firewalld bridge isolation — not applicable to Go client SDK"
statement: "Docker daemon firewalld bridge isolation — not applicable to Go client SDK"
- id: CVE-2026-41567
statement: "docker cp archive-decompression PATH hijack (moby/moby) — no fix available in the v27.x line used by github.com/docker/docker (fix requires v29.5.1 / moby/moby v2.0.0-beta.14, a breaking module-path change). Not applicable: this codebase never calls CopyToContainer/CopyFromContainer or any archive-upload API (verified via repo-wide grep for docker cp / archive endpoints) — only ServiceDeploy/ServiceScale/ServiceRemove/NetworkCreate/ContainerInspect are used. Risk accepted; revisit if a v27.x backport or a migration to moby/moby v2 lands."
- id: CVE-2026-42306
statement: "docker cp mount-redirect TOCTOU (moby/moby) — same unfixed v27.x dependency and same unused code path as CVE-2026-41567 (no CopyToContainer/CopyFromContainer/archive API usage anywhere in the repo). Risk accepted; revisit if a v27.x backport or a migration to moby/moby v2 lands."
- id: CVE-2026-41568
statement: "docker cp race-condition DoS (moby/moby) — same unfixed v27.x dependency and same unused code path as CVE-2026-41567/CVE-2026-42306 (no CopyToContainer/CopyFromContainer/archive API usage anywhere in the repo). Risk accepted; revisit if a v27.x backport or a migration to moby/moby v2 lands."
- id: GO-2026-5932
statement: "golang.org/x/crypto/openpgp is unmaintained/unsafe-by-design — not applicable, this codebase never imports x/crypto/openpgp (verified via repo-wide grep); x/crypto is used only for ssh/bcrypt/other subpackages."
8 changes: 8 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,14 @@ licenses:
--ignore github.com/pgEdge/control-plane \
--ignore github.com/eclipse/paho.golang \
--template=NOTICE.txt.tmpl > NOTICE.txt
# go-licenses duplicates the package subpath before "LICENSE" for
# opentelemetry-go's per-submodule tags (e.g. .../blob/metric/v1.44.0/metric/LICENSE),
# but the LICENSE file only exists once at the repo root, so those links 404.
# Collapse the duplicated segment; verified via HTTP status that the
# resulting root-tag URL always resolves. See
# https://github.com/google/go-licenses/issues for upstream tracking.
sed -i.bak -E 's#(open-telemetry/opentelemetry-go/blob/[a-zA-Z0-9_./-]*v[0-9]+\.[0-9]+\.[0-9]+)(/[a-zA-Z0-9_./-]+)?/LICENSE#\1/LICENSE#' NOTICE.txt
rm -f NOTICE.txt.bak

.PHONY: licenses-ci
licenses-ci: licenses
Expand Down
76 changes: 38 additions & 38 deletions NOTICE.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -474,8 +474,8 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## github.com/containerd/containerd/pkg/userns

* Name: github.com/containerd/containerd/pkg/userns
* Version: v1.7.29
* License: [Apache-2.0](https://github.com/containerd/containerd/blob/v1.7.29/LICENSE)
* Version: v1.7.34
* License: [Apache-2.0](https://github.com/containerd/containerd/blob/v1.7.34/LICENSE)

```

Expand Down Expand Up @@ -2549,8 +2549,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## github.com/go-chi/chi/v5

* Name: github.com/go-chi/chi/v5
* Version: v5.2.3
* License: [MIT](https://github.com/go-chi/chi/blob/v5.2.3/LICENSE)
* Version: v5.3.1
* License: [MIT](https://github.com/go-chi/chi/blob/v5.3.1/LICENSE)

```
Copyright (c) 2015-present Peter Kieltyka (https://github.com/pkieltyka), Google Inc.
Expand Down Expand Up @@ -4230,8 +4230,8 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## github.com/jackc/pgx/v5

* Name: github.com/jackc/pgx/v5
* Version: v5.7.6
* License: [MIT](https://github.com/jackc/pgx/blob/v5.7.6/LICENSE)
* Version: v5.10.0
* License: [MIT](https://github.com/jackc/pgx/blob/v5.10.0/LICENSE)

```
Copyright (c) 2013-2021 Jack Christensen
Expand Down Expand Up @@ -12831,8 +12831,8 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
## go.opentelemetry.io/otel

* Name: go.opentelemetry.io/otel
* Version: v1.40.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/v1.40.0/LICENSE)
* Version: v1.44.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/v1.44.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -13071,8 +13071,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## go.opentelemetry.io/otel

* Name: go.opentelemetry.io/otel
* Version: v1.40.0
* License: [BSD-3-Clause](https://github.com/open-telemetry/opentelemetry-go/blob/v1.40.0/LICENSE)
* Version: v1.44.0
* License: [BSD-3-Clause](https://github.com/open-telemetry/opentelemetry-go/blob/v1.44.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -13312,7 +13312,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

* Name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
* Version: v1.34.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/exporters/otlp/otlptrace/v1.34.0/exporters/otlp/otlptrace/LICENSE)
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/exporters/otlp/otlptrace/v1.34.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -13523,7 +13523,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

* Name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
* Version: v1.34.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/exporters/otlp/otlptrace/otlptracegrpc/v1.34.0/exporters/otlp/otlptrace/otlptracegrpc/LICENSE)
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/exporters/otlp/otlptrace/otlptracegrpc/v1.34.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -13733,8 +13733,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## go.opentelemetry.io/otel/metric

* Name: go.opentelemetry.io/otel/metric
* Version: v1.40.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/metric/v1.40.0/metric/LICENSE)
* Version: v1.44.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/metric/v1.44.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -13973,8 +13973,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## go.opentelemetry.io/otel/metric

* Name: go.opentelemetry.io/otel/metric
* Version: v1.40.0
* License: [BSD-3-Clause](https://github.com/open-telemetry/opentelemetry-go/blob/metric/v1.40.0/metric/LICENSE)
* Version: v1.44.0
* License: [BSD-3-Clause](https://github.com/open-telemetry/opentelemetry-go/blob/metric/v1.44.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -14213,8 +14213,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## go.opentelemetry.io/otel/sdk

* Name: go.opentelemetry.io/otel/sdk
* Version: v1.40.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/sdk/v1.40.0/sdk/LICENSE)
* Version: v1.44.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/sdk/v1.44.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -14453,8 +14453,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## go.opentelemetry.io/otel/sdk

* Name: go.opentelemetry.io/otel/sdk
* Version: v1.40.0
* License: [BSD-3-Clause](https://github.com/open-telemetry/opentelemetry-go/blob/sdk/v1.40.0/sdk/LICENSE)
* Version: v1.44.0
* License: [BSD-3-Clause](https://github.com/open-telemetry/opentelemetry-go/blob/sdk/v1.44.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -14693,8 +14693,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## go.opentelemetry.io/otel/trace

* Name: go.opentelemetry.io/otel/trace
* Version: v1.40.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/trace/v1.40.0/trace/LICENSE)
* Version: v1.44.0
* License: [Apache-2.0](https://github.com/open-telemetry/opentelemetry-go/blob/trace/v1.44.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -14933,8 +14933,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## go.opentelemetry.io/otel/trace

* Name: go.opentelemetry.io/otel/trace
* Version: v1.40.0
* License: [BSD-3-Clause](https://github.com/open-telemetry/opentelemetry-go/blob/trace/v1.40.0/trace/LICENSE)
* Version: v1.44.0
* License: [BSD-3-Clause](https://github.com/open-telemetry/opentelemetry-go/blob/trace/v1.44.0/LICENSE)

```
Apache License
Expand Down Expand Up @@ -15502,8 +15502,8 @@ THE SOFTWARE.
## golang.org/x/crypto

* Name: golang.org/x/crypto
* Version: v0.46.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.46.0:LICENSE)
* Version: v0.54.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.54.0:LICENSE)

```
Copyright 2009 The Go Authors.
Expand Down Expand Up @@ -15576,8 +15576,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## golang.org/x/mod

* Name: golang.org/x/mod
* Version: v0.31.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/mod/+/v0.31.0:LICENSE)
* Version: v0.37.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/mod/+/v0.37.0:LICENSE)

```
Copyright 2009 The Go Authors.
Expand Down Expand Up @@ -15613,8 +15613,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## golang.org/x/net

* Name: golang.org/x/net
* Version: v0.48.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.48.0:LICENSE)
* Version: v0.57.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.57.0:LICENSE)

```
Copyright 2009 The Go Authors.
Expand Down Expand Up @@ -15650,8 +15650,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## golang.org/x/sync

* Name: golang.org/x/sync
* Version: v0.19.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/sync/+/v0.19.0:LICENSE)
* Version: v0.22.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/sync/+/v0.22.0:LICENSE)

```
Copyright 2009 The Go Authors.
Expand Down Expand Up @@ -15687,8 +15687,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## golang.org/x/sys/unix

* Name: golang.org/x/sys/unix
* Version: v0.40.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.40.0:LICENSE)
* Version: v0.47.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.47.0:LICENSE)

```
Copyright 2009 The Go Authors.
Expand Down Expand Up @@ -15724,8 +15724,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## golang.org/x/text

* Name: golang.org/x/text
* Version: v0.32.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/text/+/v0.32.0:LICENSE)
* Version: v0.40.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/text/+/v0.40.0:LICENSE)

```
Copyright 2009 The Go Authors.
Expand Down Expand Up @@ -15798,8 +15798,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## golang.org/x/tools

* Name: golang.org/x/tools
* Version: v0.40.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/tools/+/v0.40.0:LICENSE)
* Version: v0.47.0
* License: [BSD-3-Clause](https://cs.opensource.google/go/x/tools/+/v0.47.0:LICENSE)

```
Copyright 2009 The Go Authors.
Expand Down
34 changes: 17 additions & 17 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ module github.com/pgEdge/control-plane

go 1.25.6

toolchain go1.25.8
toolchain go1.26.5

require (
github.com/alessio/shellescape v1.4.2
Expand All @@ -16,7 +16,7 @@ require (
github.com/goccy/go-yaml v1.18.0
github.com/google/uuid v1.6.0
github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6
github.com/jackc/pgx/v5 v5.7.6
github.com/jackc/pgx/v5 v5.10.0
github.com/knadh/koanf/parsers/json v0.1.0
github.com/knadh/koanf/providers/env v1.0.0
github.com/knadh/koanf/providers/file v1.1.2
Expand All @@ -41,7 +41,7 @@ require (
go.etcd.io/etcd/client/v3 v3.6.5
go.etcd.io/etcd/server/v3 v3.6.1
go.mau.fi/zerozap v0.1.1
go.opentelemetry.io/otel/trace v1.40.0
go.opentelemetry.io/otel/trace v1.44.0
go.uber.org/zap v1.27.0
goa.design/goa/v3 v3.23.4
gonum.org/v1/gonum v0.16.0
Expand All @@ -61,19 +61,19 @@ require (
github.com/beorn7/perks v1.0.1 // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/containerd/containerd v1.7.29 // indirect
github.com/containerd/containerd v1.7.34 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/platforms v0.2.1 // indirect
github.com/coreos/go-semver v0.3.1 // indirect
github.com/cpuguy83/dockercfg v0.3.2 // indirect
github.com/cpuguy83/dockercfg v0.3.2
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/dimfeld/httppath v0.0.0-20170720192232-ee938bf73598 // indirect
github.com/distribution/reference v0.6.0 // indirect
github.com/distribution/reference v0.6.0
github.com/docker/go-units v0.5.0 // indirect
github.com/fatih/structs v1.1.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.8.0 // indirect
github.com/go-chi/chi/v5 v5.2.3 // indirect
github.com/go-chi/chi/v5 v5.3.1 // indirect
github.com/go-co-op/gocron v1.37.0
github.com/go-errors/errors v1.5.1 // indirect
github.com/go-logr/logr v1.4.3 // indirect
Expand Down Expand Up @@ -145,22 +145,22 @@ require (
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
go.opentelemetry.io/otel v1.40.0 // indirect
go.opentelemetry.io/otel v1.44.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
go.opentelemetry.io/otel/metric v1.40.0 // indirect
go.opentelemetry.io/otel/sdk v1.40.0 // indirect
go.opentelemetry.io/otel/metric v1.44.0 // indirect
go.opentelemetry.io/otel/sdk v1.44.0 // indirect
go.opentelemetry.io/proto/otlp v1.5.0 // indirect
go.uber.org/atomic v1.9.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/crypto v0.46.0
golang.org/x/mod v0.31.0 // indirect
golang.org/x/net v0.48.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/sys v0.40.0 // indirect
golang.org/x/text v0.32.0 // indirect
golang.org/x/crypto v0.54.0
golang.org/x/mod v0.37.0 // indirect
golang.org/x/net v0.57.0 // indirect
golang.org/x/sync v0.22.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/text v0.40.0 // indirect
golang.org/x/time v0.12.0
golang.org/x/tools v0.40.0 // indirect
golang.org/x/tools v0.47.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect
google.golang.org/grpc v1.79.3
Expand Down
Loading