[TT-17199] test: fix flaky mcp sql aggregate tests - #1004
Open
probelabs[bot] wants to merge 1 commit into
Open
probelabs / Visor: security
succeeded
May 12, 2026 in 58s
✅ Check Passed (Warnings Found)
security check passed. Found 1 warning, but fail_if condition was not met.
Details
📊 Summary
- Total Issues: 1
- Warning Issues: 1
🔍 Failure Condition Results
Passed Conditions
- global_fail_if: Condition passed
Issues by Category
Security (1)
⚠️ pumps/mcp_sql_aggregate_test.go:207 - SQL queries are constructed usingfmt.Sprintfon lines 207, 242, 367, 382, 418, and 623. This can lead to SQL injection if the table name variable is derived from user input. In this test file, the table names are hardcoded or constants, so there is no immediate vulnerability. However, this is a dangerous pattern that should be avoided to prevent accidental introduction of vulnerabilities if copied elsewhere.
Powered by Visor from Probelabs
💡 TIP: You can chat with Visor using /visor ask <your question>
Annotations
Check warning on line 207 in pumps/mcp_sql_aggregate_test.go
probelabs / Visor: security
security Issue
SQL queries are constructed using `fmt.Sprintf` on lines 207, 242, 367, 382, 418, and 623. This can lead to SQL injection if the table name variable is derived from user input. In this test file, the table names are hardcoded or constants, so there is no immediate vulnerability. However, this is a dangerous pattern that should be avoided to prevent accidental introduction of vulnerabilities if copied elsewhere.
Raw output
To promote secure coding practices, avoid using `fmt.Sprintf` to build queries. Since table names cannot be parameterized in SQL, ensure they are from a trusted source (like constants, as is the case here). Consider adding a comment to these lines explaining that this is only safe because the table name is a hardcoded value, to warn other developers.
Loading