Is it safe to use untrusted keywords in HoneySQL maps?

[olavfosse]

Is it safe to use untrusted keywords in HoneySQL maps?

For example, is the following code vulnerable to SQL injection?

(sql/format {:select [(keyword (read-string-from-untrusted-user))]
:from :whatever})

[seancorfield]

HoneySQL makes an attempt to prevent injection via such code but you probably shouldn't rely on just that for security:

dev=> (sql/format {:select [(keyword "1; drop table users; select *")] :from :whatever})
Execution error (ExceptionInfo) at honey.sql/format-entity (sql.cljc:237).
suspicious character found in entity: 1; drop table users; select *

Currently, it only detects ; and disallows SQL entities that contain that character.

[olavfosse]

Thanks!