[dviejokfs]

Security review finding #4 — SQL injection via denylist bypass in the Postgres data-explorer (High)

Location: `crates/temps-query-postgres/src/lib.rs` (`validate_sql`)

User WHERE clauses are concatenated into `SELECT * FROM … WHERE `, guarded only by a keyword denylist applied after string literals are stripped. Data-returning functions like `query_to_xml`/`database_to_xml`/`table_to_xml` aren't on the denylist, and their SQL payload lives inside a quoted string that gets stripped before the checks run — so:

```sql
1=1 AND query_to_xml('select ... from users', true, false, '') IS NOT NULL
```

passes validation and exfiltrates other tables.

Fix

A keyword denylist can never be complete. Add a structural rule that rejects function-call syntax outright: any identifier immediately preceding `(` is treated as a function call and rejected. Only grouping parens and `IN`/`AND`/`OR`/`NOT (...)` are permitted.

With subqueries (already blocked), `UNION` (already blocked), and now function calls all rejected, a WHERE clause can reference only the current table's columns and constants — closing the cross-table exfiltration class rather than playing denylist whack-a-mole.

Note: the review also suggests enforcing a read-only DB role for browsing. That's a larger infra change (role provisioning) and is tracked separately; this PR closes the exploitable injection vector.

Verification (regression tests only)

`cargo test -p temps-query-postgres --lib` — 35 pass, including:

• `test_sql_injection_xml_function_exfiltration` — the exact `query_to_xml`/`database_to_xml`/`table_to_xml` payloads, now rejected.
• `test_sql_injection_arbitrary_function_call_blocked` — `length()`, `cast()`, `upper()`.
• `test_function_call_block_allows_grouping_and_in_lists` — legitimate grouping and `IN (...)` still validate.

`cargo clippy -p temps-query-postgres --all-targets -- -D warnings` clean.

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### Fixed

- **query-postgres:** Block function calls in data-browser WHERE clauses
- **query-postgres:** Close quoted function call bypasses
- **query-postgres:** Reject alternate subquery forms
- **query-postgres:** Parse SQL literals safely
- **query-postgres:** Handle high-bit dollar tags

### Testing

- **query-postgres:** Execute attacks against seeded table