fix: postgres init-databases.sh psql variable syntax error#8
Conversation
psql --set 변수 치환 문법(:variable)이 postgres:16 이미지에서 동작하지 않아 airflow_metadata, superset_metadata DB가 생성되지 않는 문제 수정. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe ChangesPostgres initialization refactor
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker/postgres/init-databases.sh`:
- Around line 12-13: Validate and sanitize the database name in the script
before using it in the psql CREATE DATABASE command: ensure the shell variable
database contains only allowed characters (e.g., letters, digits, underscores,
hyphens) or otherwise reject it, and escape any embedded double quotes by
doubling them (replace " with "") before interpolating into the SQL; then use
the same sanitized/escaped variable in the psql --command "CREATE DATABASE
\"$database\"" invocation so the CREATE statement is safe from names containing
quotes or invalid characters.
- Around line 8-10: The psql command in init-databases.sh interpolates $database
directly into SQL (psql ... --command "SELECT ... WHERE datname = '$database'")
creating an SQL injection risk; fix by validating or sanitizing $database before
use: add a check that $database matches a strict pattern (e.g.,
/^[a-zA-Z0-9_]+$/) and exit with error if not, or alternatively construct the
SQL using safe dollar-quoting (e.g., WHERE datname = $$<database>$$) or properly
escape single quotes, then use the validated/sanitized $database in the psql
--command invocation to ensure no untrusted characters can break out of the
string.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c5f0bf87-b0f2-434a-9c27-eb210a87c2f3
📒 Files selected for processing (1)
docker/postgres/init-databases.sh
| psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \ | ||
| --command "SELECT 1 FROM pg_database WHERE datname = '$database'" \ | ||
| --tuples-only --no-align | grep -q 1 && return 0 |
There was a problem hiding this comment.
SQL injection vulnerability in database existence check.
The $database variable is directly interpolated into the SQL WHERE clause using single quotes: datname = '$database'. If the database name contains a single quote character, it can break out of the string literal and execute arbitrary SQL.
Example attack vector:
KOIN_DATA_AIRFLOW_DB="'; DROP DATABASE postgres; --"Would result in:
SELECT 1 FROM pg_database WHERE datname = ''; DROP DATABASE postgres; --'While this script runs in a trusted container initialization context with operator-controlled environment variables, it's still a security posture gap that should be addressed.
🛡️ Proposed fix with input validation
Add input validation to ensure database names only contain safe characters:
create_database() {
local database="$1"
+
+ # Validate database name (alphanumeric, underscore only)
+ if ! [[ "$database" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
+ echo "Error: Invalid database name '$database'" >&2
+ return 1
+ fi
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \Alternatively, use PostgreSQL's dollar-quoted strings to avoid single-quote escaping issues:
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \
- --command "SELECT 1 FROM pg_database WHERE datname = '$database'" \
+ --command "SELECT 1 FROM pg_database WHERE datname = \$\$${database}\$\$" \
--tuples-only --no-align | grep -q 1 && return 0🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docker/postgres/init-databases.sh` around lines 8 - 10, The psql command in
init-databases.sh interpolates $database directly into SQL (psql ... --command
"SELECT ... WHERE datname = '$database'") creating an SQL injection risk; fix by
validating or sanitizing $database before use: add a check that $database
matches a strict pattern (e.g., /^[a-zA-Z0-9_]+$/) and exit with error if not,
or alternatively construct the SQL using safe dollar-quoting (e.g., WHERE
datname = $$<database>$$) or properly escape single quotes, then use the
validated/sanitized $database in the psql --command invocation to ensure no
untrusted characters can break out of the string.
| psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \ | ||
| --command "CREATE DATABASE \"$database\"" |
There was a problem hiding this comment.
Database creation uses safer identifier quoting but still benefits from input validation.
The double-quoted identifier syntax (CREATE DATABASE "$database") is more injection-resistant than the single-quoted string literal in the existence check above. However, database names containing double quotes would still require proper escaping ("" in PostgreSQL).
The input validation suggested in the previous comment (lines 8-10) would also protect this statement.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docker/postgres/init-databases.sh` around lines 12 - 13, Validate and
sanitize the database name in the script before using it in the psql CREATE
DATABASE command: ensure the shell variable database contains only allowed
characters (e.g., letters, digits, underscores, hyphens) or otherwise reject it,
and escape any embedded double quotes by doubling them (replace " with "")
before interpolating into the SQL; then use the same sanitized/escaped variable
in the psql --command "CREATE DATABASE \"$database\"" invocation so the CREATE
statement is safe from names containing quotes or invalid characters.
1 participant
Summary
docker/postgres/init-databases.sh의 psql--set변수 치환 문법(:variable)이 postgres:16 이미지에서 동작하지 않는 버그 수정airflow_metadata,superset_metadataDB가 초기화 시 생성되지 않아 Airflow/Superset 컨테이너가 시작 불가한 상태가 됨Test plan
docker compose down -v && docker compose up -d실행 시 Airflow/Superset이 정상 기동되는지 확인🤖 Generated with Claude Code
Summary by CodeRabbit
Note: This release contains technical infrastructure improvements with no visible changes to end-user functionality.