supabase-community / supabase-mcp / 18754101193

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(list_table): preventing sql injection attack on list_tables (#165)

* preventing sql injection attack on list_tables

* refactor: address review comments - use unknown[] and add transaction wrapper

- Replace z.any() with z.unknown() for better type safety (aligns with postgres-meta)
- Wrap query execution in transaction to prevent race conditions for future parallelization
- All 123 tests passing

* test: use division by zero payload from HackerOne report

- Changed SQL injection test to use actual payload from Linear issue AI-139
- Payload: "public') OR (SELECT 1)=1/0--" which causes division by zero error without parameterization
- With parameterized queries, returns empty array [] instead of error
- Addresses review feedback about using realistic example from original report

* chore: remove debug console.log statements

Run Details

251 of 277 branches covered (90.61%)

Branch coverage included in aggregate %.

11 of 14 new or added lines in 4 files covered. (78.57%)

1 existing line in 1 file now uncovered.

2244 of 2332 relevant lines covered (96.23%)

49.64 hits per line