From b30347483f7f86d58934a05f0a110882909bb66a Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Thu, 17 Sep 2026 04:14:41 +0000
Subject: [PATCH] harden: add parameterized queries in ogimage.mjs

SQL query constructed using JavaScript template literals with dynamic input
Addresses utils.custom.sql-injection-template-literal
---
 web/ogimage.mjs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/web/ogimage.mjs b/web/ogimage.mjs
index 6052623..5bf7076 100644
--- a/web/ogimage.mjs
+++ b/web/ogimage.mjs
@@ -47,6 +47,12 @@ const process = async (ctx, next) => {
     const token = ctx.params.token;
 
     // 1. Fetch Chat Data
+    // hal.table is an internal constant, not user input, but it is validated
+    // against a strict identifier allowlist before being interpolated to
+    // guard against SQL injection should that assumption ever change.
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(hal.table)) {
+        throw new Error('Invalid table name.');
+    }
     const result = await dbio.queryOne(
         `SELECT * FROM ${hal.table} WHERE token = $1`,
         [token]