From 686d4143664cecd121999ce39fa2e9fe49c4dffb Mon Sep 17 00:00:00 2001 From: Rin Date: Thu, 26 Feb 2026 02:16:05 +0700 Subject: [PATCH] refactor: sanitize dynamic column name in SEC form4 utility (#7376) --- openbb_platform/providers/sec/openbb_sec/utils/form4.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/openbb_platform/providers/sec/openbb_sec/utils/form4.py b/openbb_platform/providers/sec/openbb_sec/utils/form4.py index 32768c9edb0..93f2b249d8a 100644 --- a/openbb_platform/providers/sec/openbb_sec/utils/form4.py +++ b/openbb_platform/providers/sec/openbb_sec/utils/form4.py @@ -143,6 +143,9 @@ def setup_database(conn): def add_missing_column(conn, column_name): """Add a missing column to the form4_data table.""" + # Sanitize the column name to prevent SQL injection + column_name_clean = column_name.replace('"', '""') + missing_type = ( "MONEY" if "price" in column_name or "value" in column_name @@ -157,7 +160,9 @@ def add_missing_column(conn, column_name): ) ) cursor = conn.cursor() - cursor.execute(f"ALTER TABLE form4_data ADD COLUMN {column_name} {missing_type}") + cursor.execute( + f'ALTER TABLE form4_data ADD COLUMN "{column_name_clean}" {missing_type}' + ) conn.commit()