Conversation
…ai.py
POST /ai/suggest passes the caller-supplied ticket_id straight into
_fetch_ticket and _fetch_notes, which built PostgREST filter strings
by raw string interpolation (f"id=eq.{ticket_id}"). This is the same
filter-injection class fixed for main.py's routes in #18/#19 (a
crafted id could append extra query parameters, e.g.
"t1&status=eq.Closed"), but ai.py's helpers were missed.
Route both filters through the existing escape_filter_value helper
and add regression tests confirming injected id values no longer
produce extra query parameters.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F7DCf2tVL9vazNThJWioGA
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /ai/suggestpasses the caller-suppliedticket_idstraight intoai._fetch_ticketandai._fetch_notes, which built PostgREST filter strings by raw string interpolation (f"id=eq.{ticket_id}",f"ticket_id=eq.{ticket_id}").main.py's routes in fix: escape user input before interpolating into PostgREST filters #18/fix: escape id path parameter before interpolating into PostgREST filters #19 (a crafted id such ast1&status=eq.Closedcould append extra query parameters), butai.py's helpers were missed by that earlier fix.database.escape_filter_valuehelper, matching the pattern already used everywhere else in the codebase.Test plan
backend/test_ai.pywith regression tests confirming an injectedticket_idno longer produces extra query parameters for both_fetch_ticketand_fetch_notes.python -m pytest— 44 passed, 1 pre-existing failure unrelated to this change (test_get_headers_uses_supabase_keyfails in this sandbox due to a missingSUPABASE_URLenv var; reproduces identically onmainbefore this change).ruff check/ruff format --checkpass on changed files.🤖 Generated with Claude Code
https://claude.ai/code/session_01F7DCf2tVL9vazNThJWioGA
Generated by Claude Code