diff --git a/src/Databases/PostgreSQL/FetchFromPostgreSQL.cpp b/src/Databases/PostgreSQL/FetchFromPostgreSQL.cpp index a12778159b3..f81ea1ebe20 100644 --- a/src/Databases/PostgreSQL/FetchFromPostgreSQL.cpp +++ b/src/Databases/PostgreSQL/FetchFromPostgreSQL.cpp @@ -21,6 +21,7 @@ namespace DB namespace ErrorCodes { extern const int UNKNOWN_TABLE; + extern const int BAD_ARGUMENTS; } @@ -29,6 +30,13 @@ std::shared_ptr fetchPostgreSQLTableStructure( { auto columns = NamesAndTypesList(); + if (postgres_table_name.find('\'') != std::string::npos + || postgres_table_name.find('\\') != std::string::npos) + { + throw Exception(ErrorCodes::BAD_ARGUMENTS, "PostgreSQL table name cannot contain single quote or backslash characters, passed {}", + postgres_table_name); + } + std::string query = fmt::format( "SELECT attname AS name, format_type(atttypid, atttypmod) AS type, " "attnotnull AS not_null, attndims AS dims " @@ -53,7 +61,7 @@ std::shared_ptr fetchPostgreSQLTableStructure( stream.complete(); tx.commit(); } - catch (pqxx::undefined_table const &) + catch (const pqxx::undefined_table &) { throw Exception(fmt::format( "PostgreSQL table {}.{} does not exist",