{"record":{"id":"d56a99da13745750","repo":"paperclipai/paperclip","slug":"unsafe-database-name-databasename","errorCode":null,"errorMessage":"Unsafe database name: ${databaseName}","messagePattern":"Unsafe database name: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/db/src/client.ts","lineNumber":906,"sourceCode":"      const insertValues: string[] = [];\n\n      if (columnNames.has(\"hash\")) {\n        insertColumns.push(quoteIdentifier(\"hash\"));\n        insertValues.push(quoteLiteral(hash));\n      }\n      if (columnNames.has(\"name\")) {\n        insertColumns.push(quoteIdentifier(\"name\"));\n        insertValues.push(quoteLiteral(migrationFile));\n      }\n      if (columnNames.has(\"created_at\")) {\n        insertColumns.push(quoteIdentifier(\"created_at\"));\n        insertValues.push(quoteLiteral(String(folderMillis)));\n      }\n\n      if (insertColumns.length === 0) break;\n\n      await sql.unsafe(\n        `INSERT INTO ${qualifiedTable} (${insertColumns.join(\", \")}) VALUES (${insertValues.join(\", \")})`,\n      );\n      repairedMigrations.push(migrationFile);\n    }\n  } finally {\n    await sql.end();\n  }\n\n  const refreshed = await inspectMigrations(url);\n  return {\n    repairedMigrations,\n    remainingMigrations:\n      refreshed.status === \"needsMigrations\" ? refreshed.pendingMigrations : [],\n  };\n}\n\nasync function discoverMigrationTableSchema(sql: ReturnType<typeof postgres>): Promise<string | null> {\n  const rows = await sql<{ schemaName: string }[]>`\n    SELECT n.nspname AS \"schemaName\"","sourceCodeStart":888,"sourceCodeEnd":924,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/packages/db/src/client.ts#L888-L924","documentation":"Identifier-safety guard in ensurePostgresDatabase: the database name is interpolated into SQL (CREATE DATABASE / connection handling), so anything outside a plain ASCII identifier pattern is rejected to prevent injection through the name.","triggerScenarios":"Thrown at packages/db/src/client.ts:826 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a database name matching the allowed pattern (no unsafe characters or traversal)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}