The table_name parameter is directly interpolated into the SQL query string without sanitization. This creates a SQL injection vulnerability. An attacker could pass a malicious table_name that breaks out of the query structure. Use parameterized queries or validate the table_name against a whitelist of known tables.

[bio-boris]

The table_name parameter is directly interpolated into the SQL query string without sanitization. This creates a SQL injection vulnerability. An attacker could pass a malicious table_name that breaks out of the query structure. Use parameterized queries or validate the table_name against a whitelist of known tables.

    # Validate table_name against actual tables in the database
    def _get_table_names(cursor):
        cursor.execute("SELECT name FROM sqlite_master WHERE type='table'")
        return set(row[0] for row in cursor.fetchall())

    valid_tables = _get_table_names(cursor)
    if table_name not in valid_tables:
        raise ValueError(f"Invalid table name: {table_name}")

Originally posted by @Copilot in #3 (comment)