mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Ville Vesilehto
986642777c
Field names in the SQL emitted by the Compile API come from partially
evaluated refs, so a policy selecting a dynamic key such as
input.fruits[input.column] puts caller-controlled text in an identifier
position. That text was emitted verbatim, which turns
WHERE fruit.name = 'allowed'
into
WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
and an application appending the filter to its query returns rows the
policy denies.
Quote field segments that are not bare identifiers at the UCAST-to-SQL
boundary, escaping any embedded quote character. Ordinary column names
stay unquoted, so existing filters keep their current shape and remain
case-insensitive on Postgres.
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>