From 97d39b4d35254c8a58381dfb2c49cd84d432a834 Mon Sep 17 00:00:00 2001
From: Subhra264 <chakrabortysubhradeep556@gmail.com>
Date: Fri, 23 Aug 2024 12:42:10 +0530
Subject: [PATCH] fix: do not allow `SELECT *` in alert query (#4283)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit


- **New Features**
- Enhanced validation for alert creation to prevent the use of "SELECT
*" in SQL queries, improving data integrity and security during the
alert setup process.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 src/service/alerts/alert.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/service/alerts/alert.rs b/src/service/alerts/alert.rs
index e1a6152d95..713e2720d0 100644
--- a/src/service/alerts/alert.rs
+++ b/src/service/alerts/alert.rs
@@ -48,6 +48,7 @@ use crate::{
     service::{
         alerts::{build_sql, destinations},
         db,
+        search::sql::RE_ONLY_SELECT,
     },
 };
 
@@ -187,6 +188,13 @@ pub async fn save(
             {
                 return Err(anyhow::anyhow!("Alert with SQL mode should have a query"));
             }
+            if alert.query_condition.sql.is_some()
+                && RE_ONLY_SELECT.is_match(alert.query_condition.sql.as_ref().unwrap())
+            {
+                return Err(anyhow::anyhow!(
+                    "Alert with SQL can not contain SELECT * in the SQL query"
+                ));
+            }
         }
         QueryType::PromQL => {
             if alert.query_condition.promql.is_none()