d1 import: block DEFAULT/REFERENCES SQL injection into executed DDL

[mscoutermarsh]

Summary

Two related D1-import SQL injection paths let attacker-controlled dump fragments reach psql -f with the destination postgres role:

1. DEFAULT — convertDefault echoed unrecognized typed defaults verbatim, so DEFAULT (0)); DROP TABLE users; -- could escape CREATE TABLE.
2. REFERENCES tail — convertReferencesClause echoed the action tail verbatim, and parseTableBody used the last ) in RawDDL, so a dump like REFERENCES a(id) ON DELETE CASCADE); DROP TABLE users; CREATE TABLE dummy (z int ); pulled injected statements into the FK fragment and into executed DDL.

Fix

• Emit DEFAULT only for mapped functions/casts or validated scalars; omit anything else.
• Reject broken quoted literals / hostile UUID defaults.
• Reconstruct REFERENCES with an allowlisted FK-action tail only; drop unparseable clauses and tails with ; / extra parentheses.
• Parse CREATE TABLE bodies with matchingParenEnd (not LastIndex), and truncate RawDDL at that close during ParseDump.

Tests

• DEFAULT injection payloads omitted; safe numeric literals kept
• REFERENCES unit + end-to-end for the reported smuggle-after-CASCADE dump
• parseTableBody ignores SQL after the balanced close

go test ./internal/import/d1/ passes.

  

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8762d16. Configure here.}