[Security] possible SQL injection via string formatting in execute()

[tejasae-afk]

File: agents/extensions/memory/advanced_sqlite_session.py (line 349)

Building SQL queries with f-strings or % formatting lets user-controlled input alter the query structure. Use parameterized queries instead: cursor.execute("SELECT ... WHERE id = %s", (user_id,))

[seratch]

I do not think this is quite a SQL injection issue.

self.messages_table is a table identifier, not a value, and SQLite parameter binding cannot be used for identifiers, so changing this to FROM ? would not work.

While looking into this, I found a different bug: AdvancedSQLiteSession inherits custom table-name support from SQLiteSession, but still hardcodes agent_messages / agent_sessions in several places. I reproduced this with a custom messages_table, which fails with no such table: agent_messages. I will come up with a fix shortly.

[seratch]

#2694 resolves the issue I found. Thanks again for writing in.