mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
Kundan Sable
f75452bfd0
Add test_name_literal_sql_escaping.py covering the templates fixed in the CVE-2026-12044 follow-up: index Statistics (coll_stats.sql, both dialects), publications (pg + ppas), and subscriptions dependency/ get-position lookups. Each scenario renders the real template with a stacked-statement apostrophe payload and asserts (1) the object name appears exactly as qtLiteral escapes it and (2) the rendered SQL parses as exactly one statement -- the property that actually prevents statement smuggling. Verified the semantic assertion fails on the pre-patch raw-interpolation form (parses as 2 statements) and passes on the fixed form, so the test genuinely guards the fix rather than trivially passing. Complements test_stats_template_regclass_cast.py (single-index pgstatindex path) and the lint guard in test_sql_string_literal_lint.py. Pure template-render test, no DB required. Also independently verified during review: the fix's escaping neutralises a live stacked-statement injection on PostgreSQL 16 (pre-patch slept 5s, post-patch 0.0s) for both index-stats and pub/sub paths, and confirmed the browser tree label and Statistics grid render object names as React-escaped JSX text, so the HTML/XSS probe in an object name does not execute in those paths. EPAS/ppas runtime path not exercised (ppas publication templates are byte-identical to the pg variants and are covered at render level by this test).