mirror of
https://github.com/multica-ai/multica.git
synced 2026-07-08 23:06:49 +02:00
f4016fc721
Prevent cross-workspace attachment injection (CRIT-3) by verifying issue_id/comment_id belong to the caller's workspace before creating attachment records. Add workspace_id filter to ListAttachmentsByCommentIDs query (MED-3) to prevent cross-workspace attachment data leakage. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
50 lines
1.4 KiB
SQL
50 lines
1.4 KiB
SQL
-- name: CreateAttachment :one
|
|
INSERT INTO attachment (id, workspace_id, issue_id, comment_id, uploader_type, uploader_id, filename, url, content_type, size_bytes)
|
|
VALUES ($1, $2, sqlc.narg(issue_id), sqlc.narg(comment_id), $3, $4, $5, $6, $7, $8)
|
|
RETURNING *;
|
|
|
|
-- name: ListAttachmentsByIssue :many
|
|
SELECT * FROM attachment
|
|
WHERE issue_id = $1 AND workspace_id = $2
|
|
ORDER BY created_at ASC;
|
|
|
|
-- name: ListAttachmentsByComment :many
|
|
SELECT * FROM attachment
|
|
WHERE comment_id = $1 AND workspace_id = $2
|
|
ORDER BY created_at ASC;
|
|
|
|
-- name: GetAttachment :one
|
|
SELECT * FROM attachment
|
|
WHERE id = $1 AND workspace_id = $2;
|
|
|
|
-- name: ListAttachmentsByCommentIDs :many
|
|
SELECT * FROM attachment
|
|
WHERE comment_id = ANY($1::uuid[]) AND workspace_id = $2
|
|
ORDER BY created_at ASC;
|
|
|
|
-- name: ListAttachmentURLsByIssueOrComments :many
|
|
SELECT a.url FROM attachment a
|
|
WHERE a.issue_id = $1
|
|
OR a.comment_id IN (SELECT c.id FROM comment c WHERE c.issue_id = $1);
|
|
|
|
-- name: ListAttachmentURLsByCommentID :many
|
|
SELECT url FROM attachment
|
|
WHERE comment_id = $1;
|
|
|
|
-- name: LinkAttachmentsToComment :exec
|
|
UPDATE attachment
|
|
SET comment_id = $1
|
|
WHERE issue_id = $2
|
|
AND comment_id IS NULL
|
|
AND id = ANY($3::uuid[]);
|
|
|
|
-- name: LinkAttachmentsToIssue :exec
|
|
UPDATE attachment
|
|
SET issue_id = $1
|
|
WHERE workspace_id = $2
|
|
AND issue_id IS NULL
|
|
AND id = ANY($3::uuid[]);
|
|
|
|
-- name: DeleteAttachment :exec
|
|
DELETE FROM attachment WHERE id = $1 AND workspace_id = $2;
|