From 172eeebeff44d06657db751702612d7e7a94f8f6 Mon Sep 17 00:00:00 2001 From: Fang-Pen Lin Date: Thu, 23 Oct 2025 17:08:13 -0700 Subject: [PATCH] Try to fix the rotation for psql --- .../pam-resource/shared/sql/sql-resource-factory.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts b/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts index 92caefc82..c47aa8264 100644 --- a/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts +++ b/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts @@ -115,7 +115,13 @@ const makeSqlConnection = ( }, rotateCredentials: async (currentCredentials) => { const newPassword = alphaNumericNanoId(32); - await client.raw(`ALTER USER ?? WITH PASSWORD ?`, [currentCredentials.username, newPassword]); + // Note: The generated random password is not really going to make SQL Injection possible. + // The reason we are not using parameters binding is that the "ALTER USER" syntax is DDL, + // parameters binding is not supported. But just in case if the this code got copied + // around and repurposed, let's just do some naive escaping regardless + await client.raw(`ALTER USER :username: WITH PASSWORD '${newPassword.replace(/'/g, "''")}'`, { + username: currentCredentials.username + }); return { username: currentCredentials.username, password: newPassword }; }, close: () => client.destroy()