john/ember-memory-test
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(episode): BACKFILL_q-ef8eac4e-afe1-5ce2-889f-8151a8b706a2_S20260413_XX.bkf.0.warm_qdr.orphan.in.cc.es.000.BKF_J.C1A40_E.EB4-0

Browse source 
Skill: NONE | Type: chronicle
Summary: During CRISOL v4.0 pipeline testing, the F5 store phase encountered a critical f
This commit is contained in:
Ember 2026-05-11 04:58:16 +00:00
parent 777a925979
commit 750a528ea6
1 changed files with 27 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
episodes/BACKFILL_q-ef8eac4e-afe1-5ce2-889f-8151a8b706a2_S20260413_XX.bkf.0.warm_qdr.orphan.in.cc.es.000.BKF_J.C1A40_E.EB4-0.md Normal file
View file

@ -0,0 +1,27 @@
---
episode_id: "c1a40eb4-0b01-53a7-b22c-528439f9c2e8"
puente_flat: "BACKFILL_q-ef8eac4e-afe1-5ce2-889f-8151a8b706a2_S20260413_XX.bkf.0.warm_qdr.orphan.in.cc.es.000.BKF_J.C1A40_E.EB4-0"
session_code: "S20260413"
acto_dialogico: "informar"
actor_flujo: "ember_internal"
criticidad_aegis: "moderate"
skill_dominante: "NONE"
fase_proyecto: "maintenance"
tipo_semantico: "chronicle"
summary_one_line: "During CRISOL v4.0 pipeline testing, the F5 store phase encountered a critical failure when processing an episode whose title contained apostrophes. The episode title was: PostgreSQL: O'Brien's query"
source_type: "claude_code"
trust_boundary: "default"
created_at: "2026-05-10T00:00:00+00:00"
relectura_tagged: false
forgejo_commit_sha: "pending"
---
During CRISOL v4.0 pipeline testing, the F5 store phase encountered a critical failure when processing an episode whose title contained apostrophes. The episode title was: PostgreSQL: O'Brien's query with apostrophe's causing INSERT failures. The F5 PostgreSQL upsert function constructs the INSERT statement using string formatting, and the unescaped single quotes in the title broke the SQL syntax.
The error trace showed: psycopg2.errors.SyntaxError: unterminated quoted string at or near "'Brien". This is a classic SQL injection vector. While the CRISOL pipeline is not exposed to external user input (episodes are internally generated), the principle of defense in depth requires proper parameterized queries regardless of input source. The fix requires two changes.
First, the title_safe variable in crisol_run.py F5 function currently uses: title_safe = ep['title'][:200].replace("'", "''"). This manual escaping is fragile and does not handle other special characters like backslashes. The correct approach is to use psycopg2 parameterized queries: cursor.execute("INSERT INTO episodes (title, ...) VALUES (%s, ...)", (ep['title'][:200], ...)). Parameterized queries delegate escaping to the database driver, which understands the full spectrum of characters that need escaping in the target database.
Second, the PUENTE titulo_semantico in S2 segment uses kebab-case which naturally strips apostrophes, so the PUENTE itself is not affected. But the episode metadata JSON stores the original title with apostrophes, and that JSON is inserted into a JSONB column via json.dumps which handles quoting correctly. The vulnerability is specifically in the title column INSERT where string interpolation is used instead of parameterized queries.
Resolution: Replace all string-interpolated SQL in F5 with parameterized queries. Test with: O'Brien, backslash\path, percent%sign, double"quote. All four special characters must survive round-trip through INSERT and SELECT without corruption. AEGIS classification: this is a CWE-89 (SQL Injection) finding at severity medium because the input is trusted but the pattern is exploitable if the trust boundary ever expands.