lakeFS
lakeFS copied to clipboard
Lua hooks: support SQL parameters in DataBricks execute_statement
#8976 adds execute_statement. However it does not support parameters, which can set users up for SQL injection attacks due to incorrect code.
Support parameters. The DataBricks client supports Parameters in statements, and we should be able to use those from Lua. (For table names and columns, users would use named parameters together with the IDENTIFIER clause, as seen in the example on their documentation).