{"record":{"id":"a9291a8349d0901a","repo":"paperclipai/paperclip","slug":"unsafe-sql-label-value","errorCode":null,"errorMessage":"Unsafe SQL ${label}: ${value}","messagePattern":"Unsafe SQL (.+?): (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/services/plugin-database.ts","lineNumber":48,"sourceCode":"\nexport function derivePluginDatabaseNamespace(\n  pluginKey: string,\n  namespaceSlug?: string,\n): string {\n  const hash = createHash(\"sha256\").update(pluginKey).digest(\"hex\").slice(0, 10);\n  const slug = (namespaceSlug ?? pluginKey)\n    .toLowerCase()\n    .replace(/[^a-z0-9_]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\")\n    .replace(/_+/g, \"_\")\n    .slice(0, 36) || \"plugin\";\n  const namespace = `plugin_${slug}_${hash}`;\n  return namespace.slice(0, MAX_POSTGRES_IDENTIFIER_LENGTH);\n}\n\nfunction assertIdentifier(value: string, label = \"identifier\"): string {\n  if (!IDENTIFIER_RE.test(value)) {\n    throw new Error(`Unsafe SQL ${label}: ${value}`);\n  }\n  return value;\n}\n\nfunction quoteIdentifier(value: string): string {\n  return `\"${assertIdentifier(value).replaceAll(\"\\\"\", \"\\\"\\\"\")}\"`;\n}\n\nfunction splitSqlStatements(input: string): string[] {\n  const statements: string[] = [];\n  let start = 0;\n  let quote: \"'\" | \"\\\"\" | null = null;\n  let lineComment = false;\n  let blockComment = false;\n\n  for (let i = 0; i < input.length; i += 1) {\n    const char = input[i]!;\n    const next = input[i + 1];","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/services/plugin-database.ts#L30-L66","documentation":"Generic identifier guard (assertIdentifier): the supplied string (table/column/schema identifier passed by a plugin) fails IDENTIFIER_RE, so it could be unsafe to interpolate into SQL or DDL. The offending value's role is named by label; the plugin-supplied identifier is at fault.","triggerScenarios":"Thrown at server/src/services/plugin-database.ts:48 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rewrite the plugin SQL to avoid the unsafe construct named in the message."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}