From 4e15f7fe13c3c216a11e4f9160643b8eeb7ccf85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?F=C3=A9lix=20Malfait?= Date: Thu, 18 Dec 2025 08:37:43 +0100 Subject: [PATCH] Use parameterized query in getRemoteTableLocalName (#16651) This PR updates the `isNameAvailable` function in `getRemoteTableLocalName` to use parameterized queries instead of string interpolation when querying the information_schema. **Changes:** - Replaced template literal interpolation with PostgreSQL's `$1`, `$2` placeholder syntax - Parameters are now passed as a separate array argument to `dataSource.query()` This follows best practices for database queries. --- .../remote-table/utils/get-remote-table-local-name.util.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/twenty-server/src/engine/metadata-modules/remote-server/remote-table/utils/get-remote-table-local-name.util.ts b/packages/twenty-server/src/engine/metadata-modules/remote-server/remote-table/utils/get-remote-table-local-name.util.ts index 52411a3ee8..26d0686948 100644 --- a/packages/twenty-server/src/engine/metadata-modules/remote-server/remote-table/utils/get-remote-table-local-name.util.ts +++ b/packages/twenty-server/src/engine/metadata-modules/remote-server/remote-table/utils/get-remote-table-local-name.util.ts @@ -21,7 +21,8 @@ const isNameAvailable = async ( ) => { const numberOfTablesWithSameName = +( await coreDataSource.query( - `SELECT count(table_name) FROM information_schema.tables WHERE table_name LIKE '${tableName}' AND table_schema IN ('core', '${workspaceSchemaName}')`, + `SELECT count(table_name) FROM information_schema.tables WHERE table_name LIKE $1 AND table_schema IN ('core', $2)`, + [tableName, workspaceSchemaName], ) )[0].count;