File tree Expand file tree Collapse file tree 1 file changed +10
-4
lines changed
Sources/PostgresNIO/Connection Expand file tree Collapse file tree 1 file changed +10
-4
lines changed Original file line number Diff line number Diff line change @@ -131,9 +131,12 @@ public struct PostgresCopyFromFormat: Sendable {
131131///
132132/// An empty `columns` array signifies that no columns should be specified in the query and that all columns will be
133133/// copied by the caller.
134+ ///
135+ /// - Important: The table and column names are inserted into the `COPY FROM` query as passed and might thus be
136+ /// susceptible to SQL injection. Ensure no untrusted data is contained in these strings.
134137private func buildCopyFromQuery(
135- table: StaticString ,
136- columns: [ StaticString ] = [ ] ,
138+ table: String ,
139+ columns: [ String ] = [ ] ,
137140 format: PostgresCopyFromFormat
138141) -> PostgresQuery {
139142 var query = """
@@ -175,9 +178,12 @@ extension PostgresConnection {
175178 ///
176179 /// - Note: The table and column names are inserted into the SQL query verbatim. They are forced to be compile-time
177180 /// specified to avoid runtime SQL injection attacks.
181+ ///
182+ /// - Important: The table and column names are inserted into the `COPY FROM` query as passed and might thus be
183+ /// susceptible to SQL injection. Ensure no untrusted data is contained in these strings.
178184 public func copyFrom(
179- table: StaticString ,
180- columns: [ StaticString ] = [ ] ,
185+ table: String ,
186+ columns: [ String ] = [ ] ,
181187 format: PostgresCopyFromFormat = . text( . init( ) ) ,
182188 logger: Logger ,
183189 isolation: isolated ( any Actor ) ? = #isolation,
You can’t perform that action at this time.
0 commit comments