lakeFS icon indicating copy to clipboard operation
lakeFS copied to clipboard

Lua hooks: support SQL parameters in DataBricks execute_statement

Open arielshaqed opened this issue 7 months ago • 0 comments

#8976 adds execute_statement. However it does not support parameters, which can set users up for SQL injection attacks due to incorrect code. Support parameters. The DataBricks client supports Parameters in statements, and we should be able to use those from Lua. (For table names and columns, users would use named parameters together with the IDENTIFIER clause, as seen in the example on their documentation).

arielshaqed avatar Apr 28 '25 04:04 arielshaqed