From 6de90c7ce42bce9c71bd645523e0d97ac7bb19f9 Mon Sep 17 00:00:00 2001
From: Conrad Ludgate <conradludgate@gmail.com>
Date: Wed, 16 Oct 2024 12:09:25 +0100
Subject: [PATCH] quote identifiers

---
 compute_tools/src/compute.rs | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/compute_tools/src/compute.rs b/compute_tools/src/compute.rs
index b3902a6c4a..771e0db118 100644
--- a/compute_tools/src/compute.rs
+++ b/compute_tools/src/compute.rs
@@ -19,7 +19,6 @@ use futures::future::join_all;
 use futures::stream::FuturesUnordered;
 use futures::StreamExt;
 use nix::unistd::Pid;
-use postgres::config::Config;
 use postgres::error::SqlState;
 use postgres::{Client, NoTls};
 use tracing::{debug, error, info, instrument, warn};
@@ -1388,12 +1387,18 @@ LIMIT 100",
             .context("Failed to connect to the database")?;
         tokio::spawn(conn);
 
-        // todo: pg_quote
         let query = format!(
             "GRANT {} ON SCHEMA {} TO {}",
-            privileges.iter().map(|p| p.as_str()).join(", "),
-            schema_name,
-            role_name
+            privileges
+                .iter()
+                // should not be quoted as it's part of the command.
+                // is already sanitized so it's ok
+                .map(|p| serde_json::to_string(p).unwrap())
+                .collect::<Vec<String>>()
+                .join(", "),
+            // quote the schema and role name as identifiers to sanitize them.
+            schema_name.to_string().pg_quote(),
+            role_name.to_string().pg_quote(),
         );
         db_client
             .simple_query(&query)