fix: sanitize array elements in list_condition_expr to prevent SQL injection by prabhaks · Pull Request #1713 · parseablehq/parseable

prabhaks · 2026-07-02T05:29:33Z

Summary

list_condition_expr in src/alerts/alerts_utils.rs was interpolating inner_value directly into ARRAY[...] SQL expressions without any escaping or validation. This allowed crafted input like 1] OR 1=1; -- to break out of the ARRAY context and inject arbitrary SQL.

scalar_condition_expr right below it already handled this correctly (single-quote escaping, numeric/boolean validation). This PR brings list_condition_expr to the same standard.

Note: get_filter_string is a structural joiner only and handles no values directly. scalar_condition_expr already had correct escaping in place — this PR intentionally leaves both untouched.

Changes

Added a sanitize_array_elements helper that:

Splits the comma-separated array value into individual elements
Validates each element as a numeric literal, boolean literal, or properly single-quoted string
Rejects any element containing bracket characters [ or ] that could escape the ARRAY[...] context
Returns an Err describing the first offending element if validation fails

list_condition_expr now passes inner_value through this helper before interpolating it into the SQL format string.

Testing

Existing alert condition tests pass
Manually verified that 1] OR 1=1; -- now returns an error instead of being interpolated
Valid numeric, boolean, and quoted string array values still produce correct SQL
Unit tests added for sanitize_array_elements and list_condition_expr

References

Issue: Security: SQL injection risk in get_filter_string / list_condition_expr (alerts_utils.rs) #1688
Identified in PR review: feat: log context api #1687 (comment)

Summary by CodeRabbit

Bug Fixes
- Improved handling of list-based filters by safely processing comma-separated values, including quoted entries.
- Added stronger validation and normalization for list elements to prevent malformed or unsafe array input in filtering.
- Preserved numeric, boolean, and quoted string values while correctly escaping embedded quotes.
- Continued to reject unsupported filter operators and invalid bracket-based input (including unterminated quotes).
Tests
- Added unit coverage for list sanitization, quote-aware splitting, single-quote escaping, unterminated-quote errors, and filter SQL formatting/rejection.

…jection Closesparseablehq#1688 The list_condition_expr function was interpolating inner_value directly into ARRAY[...] SQL expressions without any escaping or validation, allowing crafted input like `1] OR 1=1; --` to break out of the ARRAY context and inject arbitrary SQL. scalar_condition_expr already handled escaping correctly (single-quote escaping, numeric/boolean validation). This commit brings list_condition_expr to the same standard by adding a sanitize_array_elements helper that: - Splits the value by comma - Validates each element as numeric, boolean, or a properly single-quoted string - Rejects any element containing bracket characters `[` or `]` that could escape the ARRAY literal context - Returns an Err if any element fails validation

github-actions · 2026-07-02T05:29:44Z

CLA Assistant Lite bot:
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

I have read the CLA Document and I hereby sign the CLA

Prabhakar Singh seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request}

coderabbitai · 2026-07-02T05:29:47Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 4fd9f937-e0a7-43d2-a031-0bccde7807b3

📥 Commits

Reviewing files that changed from the base of the PR and between cf7f19e and f91ac79.

📒 Files selected for processing (1)

src/alerts/alerts_utils.rs

🚧 Files skipped from review as they are similar to previous changes (1)

src/alerts/alerts_utils.rs

Walkthrough

Adds quote-aware list parsing and SQL literal sanitization in alerts_utils.rs, then uses the sanitized output in list_condition_expr for list operators. New unit tests cover splitting, escaping, and rejection cases.

Changes

Array Element Sanitization

Layer / File(s)	Summary
Sanitizer implementation and integration into list_condition_expr `src/alerts/alerts_utils.rs`	Adds quote-aware splitting and sanitization for comma-separated array elements, rejects bracket characters, normalizes quoted and bare strings, and uses the sanitized value in `list_condition_expr` for `Contains`, `DoesNotContain`, `Equal`, and `NotEqual`.
Unit tests for sanitizer and condition expressions `src/alerts/alerts_utils.rs`	Adds unit tests for splitting, escaping, unterminated quotes, bracket rejection, SQL formatting, and unsupported operator errors.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

A rabbit guards the ARRAY gate,
No stray bracket slips past the fence of fate,
Quotes get doubled, dangers fade,
Safe little strings are neatly made,
Hop, hop — the query’s sound tonight 🐰

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: sanitizing list_condition_expr array elements to prevent SQL injection.
Description check	✅ Passed	The description includes the issue fix, problem summary, chosen solution, testing notes, and references, so it is mostly complete.
Linked Issues check	✅ Passed	The PR addresses `#1688` by sanitizing list_condition_expr inputs, rejecting unsafe array values, and preserving the intended SQL behavior.
Out of Scope Changes check	✅ Passed	The changes stay within alerts_utils.rs and its tests, with no unrelated features or broad refactors beyond the SQL injection fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

prabhaks · 2026-07-02T05:31:12Z

I have read the CLA Document and I hereby sign the CLA

The bare unquoted string branch was rejecting valid values containing spaces, colons, slashes, etc. due to an alphanumeric-only allowlist. This is inconsistent with scalar_condition_expr which accepts any string and simply escapes single quotes. The bracket character check at the top already covers the actual injection vector, making the allowlist redundant. Now mirrors scalar_condition_expr: escape single quotes and wrap in single quotes, no character allowlist.

The contains("' OR '") check was a false negative — the correctly escaped output 'foo'' OR ''1''=''1' still contains that substring as part of the doubled quotes. The assert_eq on the exact escaped string is already sufficient to prove injection safety; drop the redundant contains check.

prabhaks · 2026-07-02T06:42:43Z

@nikhilsinhaparseable please review the changes whenever you get the chance. Tested locally - runs fine!

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/alerts/alerts_utils.rs`:
- Around line 473-514: The array sanitizer in sanitize_array_elements currently
splits on every comma, which breaks quoted list items containing commas. Update
the parsing logic to be quote-aware so elements like single-quoted strings with
embedded commas stay intact, while preserving the existing trimming, bracket
rejection, and re-quoting behavior used by sanitize_array_elements and
scalar_condition_expr.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ddef110e-7b9c-401a-b0ae-e26f8bd24a62

📥 Commits

Reviewing files that changed from the base of the PR and between 6dae911 and 75e9a70.

📒 Files selected for processing (1)

src/alerts/alerts_utils.rs

The previous value.split(',') broke on quoted elements that contained commas, e.g. 'New York, NY' was split into two invalid fragments. Replace it with a hand-rolled quote-aware splitter that: - Treats '' inside a quoted string as an escaped quote (not a close) - Only splits on commas that appear outside of single-quoted strings - Rejects unterminated quoted strings with a clear error - Preserves all existing trimming, bracket-rejection, and re-quoting behaviour unchanged New tests cover: comma inside a quoted element, comma inside a quoted element that also contains a doubled-quote escape, mixed quoted and numeric elements, and an unterminated quote error.

Replace `.map(|(b, _)| b).unwrap_or(value.len())` with `.map_or(value.len(), |(b, _)| b)` in all three byte-offset lookups inside split_array_elements. Fixes: - clippy::unwrap_or_else_default (unwrap_or followed by a function call) - clippy::map_unwrap_or (.map().unwrap_or() on Option)

prabhaks · 2026-07-03T14:47:05Z

Do you know why the CI(coverage and load test) is taking lot of time?

nitisht · 2026-07-04T07:57:06Z

Looks good - thanks for the PR @prabhaks

Do you know why the CI(coverage and load test) is taking lot of time?

For external contributions we require a manual approval of the CI workflow, probably that is why.

nitisht added a commit to parseablehq/.github that referenced this pull request Jul 2, 2026
@prabhakshas signed the CLA inparseablehq/parseable#1713
230a615

Prabhakar Singh added 3 commits July 1, 2026 22:41

test: add unit tests for sanitize_array_elements and list_condition_expr
9b63db9

prabhaks marked this pull request as ready for review July 2, 2026 06:41

coderabbitaiBot requested changes Jul 2, 2026
View reviewed changes

Comment threadsrc/alerts/alerts_utils.rs

nitisht requested review from nikhilsinhaparseable and parmesant July 2, 2026 08:04

Prabhakar Singh added 2 commits July 2, 2026 07:56

Merge branch 'main' into fix/sql-injection-list-condition-expr
cf7f19e

coderabbitaiBot previously approved these changes Jul 2, 2026
View reviewed changes

prabhaks dismissed coderabbitai[bot]’s stale review via f91ac79July 2, 2026 15:06

coderabbitaiBot approved these changes Jul 2, 2026
View reviewed changes

nitisht approved these changes Jul 4, 2026
View reviewed changes

nitisht merged commit d2507cc into parseablehq:mainJul 4, 2026
12 checks passed

coderabbitaiBot mentioned this pull request Jul 14, 2026
fix: user auth for datasets #1725
Merged

Navigation Menu

Uh oh!

Uh oh!

fix: sanitize array elements in list_condition_expr to prevent SQL injection - #1713

fix: sanitize array elements in list_condition_expr to prevent SQL injection#1713
nitisht merged 7 commits into
parseablehq:mainfrom
prabhaks:fix/sql-injection-list-condition-expr

prabhaks commented Jul 2, 2026•
edited by coderabbitai Bot
Loading

Uh oh!

github-actionsBot commented Jul 2, 2026•
edited
Loading

Uh oh!

coderabbitaiBot commented Jul 2, 2026•
edited
Loading

Uh oh!

prabhaks commented Jul 2, 2026

Uh oh!

prabhaks commented Jul 2, 2026

Uh oh!

coderabbitaiBot left a comment

Uh oh!

Uh oh!

prabhaks commented Jul 3, 2026

Uh oh!

nitisht commented Jul 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

prabhaks commented Jul 2, 2026• edited by coderabbitai BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

References

Summary by CodeRabbit

Uh oh!

github-actionsBot commented Jul 2, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitaiBot commented Jul 2, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

prabhaks commented Jul 2, 2026

Uh oh!

prabhaks commented Jul 2, 2026

Uh oh!

coderabbitaiBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

prabhaks commented Jul 3, 2026

Uh oh!

nitisht commented Jul 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

prabhaks commented Jul 2, 2026•
edited by coderabbitai Bot
Loading

github-actionsBot commented Jul 2, 2026•
edited
Loading

coderabbitaiBot commented Jul 2, 2026•
edited
Loading