langchain-ai/langgraph
1
0
Fork 0
mirror of https://github.com/langchain-ai/langgraph.git synced 2026-07-15 12:35:43 -04:00
Code Issues 314 Packages Projects Releases 17 Wiki Activity

[PR #6328] fix(checkpoint-postgres): Replace f-string SQL formatting with parameterized queries in migration statements #4981

New Issue
Closed
opened 2026-02-20 17:51:03 -05:00 by yindo · 0 comments
yindo commented 2026-02-20 17:51:03 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langchain-ai/langgraph/pull/6328

State: closed
Merged: Yes

Summary

Replace f-string SQL formatting with parameterized queries to prevent potential SQL injection in checkpoint migration code.

Changes

Updated the migration version tracking INSERT statements in all checkpoint saver classes to use parameterized queries instead of f-string formatting:

  • PostgresSaver (libs/checkpoint-postgres/langgraph/checkpoint/postgres/__init__.py:100)
  • AsyncPostgresSaver (libs/checkpoint-postgres/langgraph/checkpoint/postgres/aio.py:104-106)
  • ShallowPostgresSaver (libs/checkpoint-postgres/langgraph/checkpoint/postgres/shallow.py:255)
  • AsyncShallowPostgresSaver (libs/checkpoint-postgres/langgraph/checkpoint/postgres/shallow.py:617-619)

Before (vulnerable to SQL injection):

cur.execute(f"INSERT INTO checkpoint_migrations (v) VALUES ({v})")

After (using parameterized query):

cur.execute("INSERT INTO checkpoint_migrations (v) VALUES (%s)", (v,))

Risk Assessment

The practical risk is low since v is an integer loop variable controlled by the codebase. However, using string formatting in SQL queries is a well-known anti-pattern that can lead to SQL injection vulnerabilities, especially if the code is later refactored or copied to other contexts.

Testing

  • ✅ All 216 tests passing on PostgreSQL 15 and 16
  • ✅ Linting and type checking passing
  • ✅ No functional changes to behavior
**Original Pull Request:** https://github.com/langchain-ai/langgraph/pull/6328 **State:** closed **Merged:** Yes --- ## Summary Replace f-string SQL formatting with parameterized queries to prevent potential SQL injection in checkpoint migration code. ## Changes Updated the migration version tracking INSERT statements in all checkpoint saver classes to use parameterized queries instead of f-string formatting: - `PostgresSaver` (libs/checkpoint-postgres/langgraph/checkpoint/postgres/__init__.py:100) - `AsyncPostgresSaver` (libs/checkpoint-postgres/langgraph/checkpoint/postgres/aio.py:104-106) - `ShallowPostgresSaver` (libs/checkpoint-postgres/langgraph/checkpoint/postgres/shallow.py:255) - `AsyncShallowPostgresSaver` (libs/checkpoint-postgres/langgraph/checkpoint/postgres/shallow.py:617-619) **Before (vulnerable to SQL injection):** ```python cur.execute(f"INSERT INTO checkpoint_migrations (v) VALUES ({v})") ``` **After (using parameterized query):** ```python cur.execute("INSERT INTO checkpoint_migrations (v) VALUES (%s)", (v,)) ``` ## Risk Assessment The practical risk is low since `v` is an integer loop variable controlled by the codebase. However, using string formatting in SQL queries is a well-known anti-pattern that can lead to SQL injection vulnerabilities, especially if the code is later refactored or copied to other contexts. ## Testing - ✅ All 216 tests passing on PostgreSQL 15 and 16 - ✅ Linting and type checking passing - ✅ No functional changes to behavior
yindo added the pull-request label 2026-02-20 17:51:03 -05:00
yindo closed this issue 2026-02-20 17:51:03 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agents
awaiting author revision
bug
change
chat models
checkpointer
ci
code quality
code quality
dependencies
documentation
drawing
duplicate
enhancement
good first issue
help wanted
invalid
maintainer
meta
missing information
not maintained by langchain
open-swe-auto
open-swe-max
open-swe-max-auto
pending
performance
pull-request
Mirrored from GitHub Pull Request
 question
requires design
sdk
server
stale
studio
tests
type checking
usage question
v0.5
v1.1
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/langgraph#4981
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?