rust: Add config-derived table name barrier for SQL injection

[Chanel (chanel-y)]

Description

This PR adds a ConfigDerivedTableNameBarrier to the Rust SQL-injection query. It treats reads of struct fields whose names denote a database identifier — matching (?i).*(table|collection|schema|bucket|index|view)(_name)?$ — as taint barriers. These fields are, by convention, populated at service startup from hardcoded strings or configuration rather than from per-request user input, so interpolating them into a query string is not user-controlled SQL injection.

False positives eliminated

All three alerts come from the same delete_aggregate method in Nexus.Foundation/crates/nexus-persistence/src/es/store.rs . In each case the only value interpolated into the SQL text is an internal table-identifier field ( self.events_table , self.snapshots_table , self.view_table ), while the sole request-derived value ( aggregate_id ) is safely parameterized with .bind(...) / $1 .

The table-identifier fields are initialized once from the aggregate type name (a compile-time/config constant), never from request data:

// AggregateTableConfig::new(aggregate_name) — service setup, not request data
Self {
events_table: format!("{}_events", aggregate_name),
snapshots_table: format!("{}_snapshots", aggregate_name),
view_table: format!("{}_view", aggregate_name),
}

1. store.rs:74 — events_table

Alert: https://codeql.microsoft.com/issues/85f36f3f-1401-45a7-a1d6-ea277c2f4933?Campaign=5272e251cdc44e9eaa056e5b1c1a1c06

if let Err(e) = sqlx::query(&format!(
"DELETE FROM {} WHERE aggregate_id = $1",
self.events_table // internal identifier — the only {} filler
))
.bind(aggregate_id) // request value — parameterized as $1
.execute(pool)
.await

2. store.rs:91 — snapshots_table

Alert: https://codeql.microsoft.com/issues/a3e7f634-5aee-4bfc-b242-d7cd453021be?Campaign=5272e251cdc44e9eaa056e5b1c1a1c06

if let Err(e) = sqlx::query(&format!(
"DELETE FROM {} WHERE aggregate_id = $1",
self.snapshots_table // internal identifier — the only {} filler
))
.bind(aggregate_id) // request value — parameterized as $1
.execute(pool)
.await

3. store.rs:108 — view_table

Alert: https://codeql.microsoft.com/issues/cd77a610-9abb-4125-b138-51d04b4fd1a9?Campaign=5272e251cdc44e9eaa056e5b1c1a1c06

let result = sqlx::query(&format!(
"DELETE FROM {} WHERE view_id = $1",
self.view_table // internal identifier — the only {} filler
))
.bind(aggregate_id) // request value — parameterized as $1
.execute(pool)
.await?;

Why this fixes the false positives

CodeQL reports these because its taint tracking follows values into the format! → sqlx::query sink. But the only value spliced into the SQL structure is a table identifier read from an internal struct field ( self.events_table etc.), which is a FieldExpr whose identifier ends in table / view . The new ConfigDerivedTableNameBarrier marks such field reads as barriers, so the config-derived identifier no longer taints the query. The request-controlled aggregate_id is unaffected — it is already safe because it is bound as $1 rather than concatenated.