Since $dumpMetaTableName and $identifierPropertiesTableName are used in raw queries, with on $db->tableName() called on them, they need to strictly validate that the name is a simple string and does not contain sql. Database::tableName() is not safe for preventing sql injection.
It looks like you can validate that they match /[a-z_]+/.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Lydia_Pintscher | T99351 Review and deploy Wikibase-Quality on wikidata.org | |||
| Resolved | Lydia_Pintscher | T99354 Review and deploy Wikibase-Quality-Constraints on wikidata.org | |||
| Invalid | None | T103817 [Epic] version 2 of the quality extensions | |||
| Declined | None | T99357 [Story] Review and deploy Wikibase-Quality-External-Validation on wikidata.org | |||
| Declined | None | T99358 [Task] Security review of Wikibase-Quality-External-Validation branch master | |||
| Resolved | • csteipp | T103439 Ex:WikibaseQualityExternalValidation - DumpMetaInformationRepo needs to strictly validate table names |
Tables names are no longer injected into the database services, but stored as constants. Is this still necessary?
Please note, that the repository has changed.