Skip to content

Commit 27f0c47

Browse files
committed
Allow String to be used for table and column names in COPY FROM
1 parent 568d258 commit 27f0c47

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

Sources/PostgresNIO/Connection/PostgresConnection+CopyFrom.swift

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -131,9 +131,12 @@ public struct PostgresCopyFromFormat: Sendable {
131131
///
132132
/// An empty `columns` array signifies that no columns should be specified in the query and that all columns will be
133133
/// copied by the caller.
134+
///
135+
/// - Important: The table and column names are inserted into the `COPY FROM` query as passed and might thus be
136+
/// susceptible to SQL injection. Ensure no untrusted data is contained in these strings.
134137
private func buildCopyFromQuery(
135-
table: StaticString,
136-
columns: [StaticString] = [],
138+
table: String,
139+
columns: [String] = [],
137140
format: PostgresCopyFromFormat
138141
) -> PostgresQuery {
139142
var query = """
@@ -175,9 +178,12 @@ extension PostgresConnection {
175178
///
176179
/// - Note: The table and column names are inserted into the SQL query verbatim. They are forced to be compile-time
177180
/// specified to avoid runtime SQL injection attacks.
181+
///
182+
/// - Important: The table and column names are inserted into the `COPY FROM` query as passed and might thus be
183+
/// susceptible to SQL injection. Ensure no untrusted data is contained in these strings.
178184
public func copyFrom(
179-
table: StaticString,
180-
columns: [StaticString] = [],
185+
table: String,
186+
columns: [String] = [],
181187
format: PostgresCopyFromFormat = .text(.init()),
182188
logger: Logger,
183189
isolation: isolated (any Actor)? = #isolation,

0 commit comments

Comments
 (0)