#384 CRITICAL: SQL injection via dynamic table names in absurd_client

closed critical Created 2025-12-11 22:21 · Updated 2025-12-12 14:48

Description

Edit
absurd_client.py uses f-strings for table names in multiple locations (e.g., line 657-664). While queue_name has regex validation at init, should use psycopg.sql.Identifier for all dynamic table/schema names for defense in depth.

Comments

Loading comments...

Context

Loading context...

Audit History

View All
Loading audit history...