ScalaSQL: Identifier escape() does not escape a quote or bracket inside a name
Confirmed · medium · Security vulnerability
Table and column names that hold the dialect's delimiter break out of the quoted identifier. If such names come from untrusted data, they can alter the generated SQL.
Found: ; reported: ; status since: . Reporter: Mike Murunov
Page for this report · Public report
Agreed on the proposed fix.