feat(sql): SQL Injection

build/truncate.go

@@ -8,12 +8,19 @@ import (
 )
 
 func TruncateSQL(s *schema.Table, cascade bool, restartIdentity bool) (string, error) {
-	query := fmt.Sprintf("TRUNCATE TABLE %s", utils.SQLQuoteIdent(s.Name))
-	if cascade {
-		query += " CASCADE"
+	if s == nil {
+		return "", fmt.Errorf("nil table provided")
 	}
+	if s.Name == "" || !utils.IsValidIdentifier(s.Name) {
+		return "", fmt.Errorf("invalid table name: %q", s.Name)
+	}
+
+	query := fmt.Sprintf("TRUNCATE TABLE %s", utils.SQLQuoteIdent(s.Name))
 	if restartIdentity {
 		query += " RESTART IDENTITY"
 	}
+	if cascade {
+		query += " CASCADE"
+	}
 	return query, nil
 }