News for hackers. Stuff that matters.

A comment on Pipe Syntax in SQL. Parent comment

Re:Pipe Syntax in SQL by xigoi on Sunday August 25, 2024 @05:31AM (#41345889)
The very first example on that page is vulnerable to injection.
[ Parent | on HN ]
Re:Pipe Syntax in SQL by richbell on Sunday August 25, 2024 @12:11PM (#41348414)
Which one?
[ Parent | on HN ]
Re:Pipe Syntax in SQL by xigoi on Sunday August 25, 2024 @12:24PM (#41348548) 

  #!/bin/bash 
  function csv_to_parquet() {     
      file_path="$1"     
      duckdb -c "COPY (SELECT * FROM read_csv_auto('$file_path')) TO '${file_path%.*}.parquet' (FORMAT PARQUET);" }
[ Parent | on HN ]
Re:Pipe Syntax in SQL by richbell on Sunday August 25, 2024 @09:59PM (#41353333)
Eh, in the context of the site and other snippets that seems pedantic.

Could it be run on untrusted user input? Sure. Does it actually pose a threat? It's improbable.

[ Parent | on HN ]