hsiegeln abed4dc96f security: fix SQL injection in ClickHouse query escaping ...

Convert ClickHouseUsageTracker and ClickHouseMetricsQueryStore to
use JDBC parameterized queries (? binds) — these query raw tables
without AggregateFunction columns.

Fix lit(String) in RouteMetricsController and ClickHouseStatsStore
to escape backslashes before single quotes. Without this, an input
like \' breaks out of the string literal in ClickHouse (where \
is an escaped backslash). These must remain as literal SQL because
the ClickHouse JDBC 0.9.x driver wraps PreparedStatement in
sub-queries that strip AggregateFunction types, breaking -Merge
combinators.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-04 12:17:12 +02:00

..

src

security: fix SQL injection in ClickHouse query escaping

2026-04-04 12:17:12 +02:00

pom.xml

feat: remove OpenSearch, add ClickHouse admin page

2026-04-01 18:56:06 +02:00