Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: insecure go expression #1384

Merged
merged 2 commits into from
Dec 7, 2022
Merged

fix: insecure go expression #1384

merged 2 commits into from
Dec 7, 2022

Conversation

mnagaa
Copy link
Contributor

@mnagaa mnagaa commented Nov 23, 2022

This PR fixes insecure go expression.

pkg/snowflake/table_constraint.go:224:10: G201: SQL string formatting (gosec)
        stmt := fmt.Sprintf(`SELECT * FROM SNOWFLAKE.INFORMATION_SCHEMA.TABLE_CONSTRAINTS WHERE TABLE_NAME = '%v' AND TABLE_SCHEMA = '%v' AND TABLE_CATALOG = '%v' AND CONSTRAINT_NAME = '%v'`, tableName, tableSchema, tableDB, name)
                ^
pkg/snowflake/tag_association.go:99:10: G201: SQL string formatting (gosec)
        stmt := fmt.Sprintf(`SELECT SYSTEM$GET_TAG('"%v"."%v"."%v"', '%v', '%v') TAG_VALUE WHERE TAG_VALUE IS NOT NULL`, tb.databaseName, tb.schemaName, tb.tagName, tb.objectIdentifier, tb.objectType)

Refs:
https://securego.io/docs/rules/g201-g202.html

@sfc-gh-swinkler sfc-gh-swinkler merged commit a6c8e75 into Snowflake-Labs:main Dec 7, 2022
@snowflake-release-please snowflake-release-please bot mentioned this pull request Dec 7, 2022
Merged
@sfc-gh-swinkler
Copy link
Collaborator

Good catch. Thanks @mnagaa !

ChrisIsidora added a commit to ChrisIsidora/terraform-provider-snowflake that referenced this pull request Dec 7, 2022
@ChrisIsidora
Fix: Go Expression Fix Snowflake-Labs#1384
b164fb6
@ChrisIsidora ChrisIsidora mentioned this pull request Dec 7, 2022
Merged
sfc-gh-swinkler pushed a commit that referenced this pull request Dec 7, 2022
@ChrisIsidora
fix: Go Expression Fix #1384 (#1403)
8936e1a 
* Fix: Go Expression Fix #1384

* Fixed docs

* Fixed Error Unwrapping

* Ran Fmt
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sfc-gh-swinkler sfc-gh-swinkler sfc-gh-swinkler approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@mnagaa @sfc-gh-swinkler