You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We should validate and sanitize the service name for schema publishes and schema checks. Right now the service string can be anything, including whitespace and special characters.
We should limit it more to have:
maximum length
disallow spaces
disallow certain special characters
We need to consider already existing services published to our database and ensure that introducing the limits does not break any existing users.
Characters used within our pg database today:
"-./0123456789_abcdefghijklmnopqrstuvwxyz{}“”
how we extracted the list
select string_agg(c,'')
from (
select distinct regexp_split_to_table(lower(service_name),'') as c
from schema_log
) t
Some of those look like unintended user mistakes when publishing the schema:
{ and } seem like wrongly interpolated environment variables on CI systems (projects using this are not active; or all services deleted)
” and ” also seem like wrongly interpolated environment variables on CI systems (project using this are not active; or all services deleted)
Proposed allowed characters:
alphanumeric
dots
underscore
slash
dash
The text was updated successfully, but these errors were encountered:
n1ru4l
changed the title
sanitzie/validate service name input
sanitize/validate service name input
Jan 27, 2025
We should validate and sanitize the service name for schema publishes and schema checks. Right now the service string can be anything, including whitespace and special characters.
We should limit it more to have:
We need to consider already existing services published to our database and ensure that introducing the limits does not break any existing users.
Characters used within our pg database today:
how we extracted the list
Some of those look like unintended user mistakes when publishing the schema:
{
and}
seem like wrongly interpolated environment variables on CI systems (projects using this are not active; or all services deleted)”
and”
also seem like wrongly interpolated environment variables on CI systems (project using this are not active; or all services deleted)Proposed allowed characters:
The text was updated successfully, but these errors were encountered: