mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-18 00:03:11 +00:00

Files

T

Ruben FiszelandClaude Opus 5.5 3f46ff8118 fix(worker): escape contextual variables substituted into SQL string literals

%%WM_*%% contextual variables were substituted into SQL as raw text, so a
value carrying a quote (an end-user email such as x'/**/OR/**/'1'='1'--@e.com
in WM_END_USER_EMAIL) could break out of the surrounding string literal and
run with the app author's database credentials.

Escape each value for the dialect's single-quoted literal: '' for PostgreSQL,
MSSQL, Oracle and DuckDB; \\ plus '' for MySQL and Snowflake (a quoted email
local part can carry a backslash, which those dialects treat as an escape);
\\ plus \' for BigQuery, which does not accept ''.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-23 15:42:31 +02:00

nsjail

fix: stream ansible playbook logs in real time (#10669 )

2026-08-12 21:52:09 +02:00

src

fix(worker): escape contextual variables substituted into SQL string literals

2026-09-23 15:42:31 +02:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

feat: ingest dbt column lineage and real column schemas from the engine's parquet index (#10977 )