🛡️ Sentinel: [CRITICAL] Fix SQL injection in jsonExtract parameterization

.jules/sentinel.md

@@ -7,3 +7,8 @@
 **Vulnerability:** The daemon configuration file (`~/.agor/config.yaml`) and its parent directory (`~/.agor`) were created with default file permissions (e.g., `0o755`/`0o644`), which made them readable by other users on the system. This file stores extremely sensitive information such as API keys and master JWT secrets.
 **Learning:** Default Node.js filesystem operations (`fs.writeFile` and `fs.mkdir`) do not enforce strict permissions unless explicitly specified with a `mode` parameter. When handling sensitive files, relying on the system `umask` is insufficient.
 **Prevention:** Always specify `mode: 0o600` for sensitive files and `mode: 0o700` for their parent directories. Additionally, use `fs.chmod` to retroactively secure existing files and directories that might have been created with permissive defaults.
+
+## 2024-05-22 - [SQL Injection Risk via sql.raw in jsonExtract]
+**Vulnerability:** A potential SQL injection vulnerability in `jsonExtract` helper inside `packages/core/src/db/database-wrapper.ts`. The code used `sql.raw` to dynamically construct JSONb object keys when extracting data, avoiding Drizzle's parameterization.
+**Learning:** Overusing `sql.raw` with unvalidated input arrays opens the system up to SQL injection. When trying to cast variables while constructing dynamic SQL, use explicit template literals (like `sql\`->> (\${key}::text)\``) instead of bypassing parameterization with `sql.raw`.
+**Prevention:** Avoid `sql.raw` unless absolutely necessary (like static SQL constructs). Ensure dynamically constructed arrays and strings utilize Drizzle's built-in parameterization and explicit casting to correct data types like `text` when using PostrgreSQL JSONb operators.

packages/core/src/db/database-wrapper.ts

@@ -105,15 +105,15 @@ export function jsonExtract(db: Database, column: SQL.Aliased | SQL | any, path:
   } else {
     // PostgreSQL: column->'path'->'to'->>'field'
     // Use -> for all but the last part (keeps as JSON), ->> for the last part (extracts as text)
-    // IMPORTANT: Use sql.raw() for JSON keys to avoid parameterization
+    // Use explicit casts to text to avoid parameterization typing issues while maintaining safety
     if (parts.length === 1) {
       // Single level: column->>'key'
-      return sql`${column}${sql.raw(`->>'${parts[0]}'`)}`;
+      return sql`${column} ->> (${parts[0]}::text)`;
     } else {
       // Multiple levels: column->'key1'->'key2'->>'key3'
-      const objectParts = parts.slice(0, -1).map((p) => sql.raw(`->'${p}'`));
+      const objectParts = parts.slice(0, -1).map((p) => sql`-> (${p}::text)`);
       const lastPart = parts[parts.length - 1];
-      return sql`${column}${sql.join(objectParts, sql``)}${sql.raw(`->>'${lastPart}'`)}`;
+      return sql`${column} ${sql.join(objectParts, sql` `)} ->> (${lastPart}::text)`;
     }
   }
 }