add quotes to COUNT query to add SQL injection protection

InseeFr · Jul 11, 2024 · 9ddc524 · 9ddc524
1 parent 07e0124
commit 9ddc524
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/kraftwerk-core/src/main/java/fr/insee/kraftwerk/core/outputs/csv/CsvOutputFiles.java b/kraftwerk-core/src/main/java/fr/insee/kraftwerk/core/outputs/csv/CsvOutputFiles.java
@@ -97,7 +97,8 @@ public void writeOutputTables(Map<String, MetadataModel> metadataModels) throws
 
 				//Count rows for functional log
 				if (kraftwerkExecutionLog != null) {
-					try(ResultSet countResult = this.getDatabase().executeQuery("SELECT COUNT(*) FROM " + datasetName)){
+					try(ResultSet countResult =
+								this.getDatabase().executeQuery("SELECT COUNT(*) FROM '%s'".formatted(datasetName))){
 						countResult.next();
                         kraftwerkExecutionLog.getLineCountByTableMap().put(datasetName, countResult.getInt(1));
 					}