From bd6ab6c834b986241765736ef5e21bc8eaae5a35 Mon Sep 17 00:00:00 2001
From: Donach <39565367+Donach@users.noreply.github.com>
Date: Sun, 2 Aug 2026 06:50:54 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL]?=
 =?UTF-8?q?=20Fix=20SQL=20injection=20via=20sql.raw=20in=20jsonExtract?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packages/core/src/db/database-wrapper.ts | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/packages/core/src/db/database-wrapper.ts b/packages/core/src/db/database-wrapper.ts
index d52d553e64..0f780ff0d3 100644
--- a/packages/core/src/db/database-wrapper.ts
+++ b/packages/core/src/db/database-wrapper.ts
@@ -105,15 +105,14 @@ export function jsonExtract(db: Database, column: SQL.Aliased | SQL | any, path:
   } else {
     // PostgreSQL: column->'path'->'to'->>'field'
     // Use -> for all but the last part (keeps as JSON), ->> for the last part (extracts as text)
-    // IMPORTANT: Use sql.raw() for JSON keys to avoid parameterization
     if (parts.length === 1) {
       // Single level: column->>'key'
-      return sql`${column}${sql.raw(`->>'${parts[0]}'`)}`;
+      return sql`${column} ->> (${parts[0]}::text)`;
     } else {
       // Multiple levels: column->'key1'->'key2'->>'key3'
-      const objectParts = parts.slice(0, -1).map((p) => sql.raw(`->'${p}'`));
+      const objectParts = parts.slice(0, -1).map((p) => sql`-> (${p}::text)`);
       const lastPart = parts[parts.length - 1];
-      return sql`${column}${sql.join(objectParts, sql``)}${sql.raw(`->>'${lastPart}'`)}`;
+      return sql`${column} ${sql.join(objectParts, sql` `)} ->> (${lastPart}::text)`;
     }
   }
 }