[release-23.0] Potential fix for code scanning alert no. 3944: Database query built … (#18963)

timvaillancourt · web-flow · commit c687c25a165f · 2025-12-03T11:12:54.000+01:00
Signed-off-by: Tim Vaillancourt &lt;tim@timvaillancourt.com&gt;
diff --git a/go/vt/vtadmin/api.go b/go/vt/vtadmin/api.go
@@ -2657,11 +2657,14 @@ func (api *API) VExplain(ctx context.Context, req *vtadminpb.VExplainRequest) (*
 		return nil, err
 	}
 
-	if _, ok := stmt.(*sqlparser.VExplainStmt); !ok {
+	vexplainStmt, ok := stmt.(*sqlparser.VExplainStmt)
+	if !ok {
 		return nil, vterrors.VT09017("Invalid VExplain statement")
 	}
 
-	response, err := c.DB.VExplain(ctx, req.GetSql(), stmt.(*sqlparser.VExplainStmt))
+	// Canonicalize the SQL using the AST, to prevent use of raw user input.
+	canonicalQuery := sqlparser.String(vexplainStmt)
+	response, err := c.DB.VExplain(ctx, canonicalQuery, vexplainStmt)
 
 	if err != nil {
 		return nil, err

Original file line number	Diff line number	Diff line change
`@@ -2657,11 +2657,14 @@ func (api API) VExplain(ctx context.Context, req vtadminpb.VExplainRequest) (*`
`2657`	`2657`	`return nil, err`
`2658`	`2658`	`}`
`2659`	`2659`
`2660`		`- if _, ok := stmt.(*sqlparser.VExplainStmt); !ok {`
	`2660`	`+ vexplainStmt, ok := stmt.(*sqlparser.VExplainStmt)`
	`2661`	`+ if !ok {`
`2661`	`2662`	`return nil, vterrors.VT09017("Invalid VExplain statement")`
`2662`	`2663`	`}`
`2663`	`2664`
`2664`		`- response, err := c.DB.VExplain(ctx, req.GetSql(), stmt.(*sqlparser.VExplainStmt))`
	`2665`	`+ // Canonicalize the SQL using the AST, to prevent use of raw user input.`
	`2666`	`+ canonicalQuery := sqlparser.String(vexplainStmt)`
	`2667`	`+ response, err := c.DB.VExplain(ctx, canonicalQuery, vexplainStmt)`
`2665`	`2668`
`2666`	`2669`	`if err != nil {`
`2667`	`2670`	`return nil, err`