fix: 修复签到/群管/快问快答插件的 SQL 注入，并沉淀 SDK 级参数化查询 - #19
Merged
Conversation
- checkin: user_name(QQ昵称) 直接拼入 SQL 的注入点，改用 jn.sql.escape 转义 - redrock_group_manager: set_kv/get_kv/migrate 的 key/value 拼接统一转义 - redrock_quiz: save_game/get_game/delete_game 的 key/value 统一转义 - sdk: 新增 jn.sql.escape（PostgreSQL 单引号翻倍转义），供所有插件复用 - 同步 group_manager/quiz 插件内的 jn.lua SDK 副本
- jn.database.query/exec 支持可选绑定参数（SQL 用 ? 占位）后， 将 9 处拼接 SQL 全部改为参数化：checkin 4 处、group_manager 3 处、quiz 3 处 - 数字/字符串字段均由数据库驱动参数编码，无需再手动转义 - 同步 sdk/jn.lua 与两个插件的 jn.lua SDK 副本的类型注解
ghost
requested a review
from excniesNIED
August 8, 2026 18:55
ghost
added
the 此前一次 revert+合并冲突时，冲突标记被误提交（188ccef），导致 redrock_group_manager 的 pluggin.yaml 无法解析、store 校验失败。 本次移除冲突标记，保留正确版本：redrock_group_manager 1.2.5、 plugins.json 时间戳 2026-08-09T02:57:36+08:00。
excniesNIED
approved these changes
Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📌 背景
jn.database.query/exec只暴露裸 SQL 接口，插件里直接拼接用户输入（QQ 昵称、群消息原文）存在 SQL 注入风险。本次对全部实际使用数据库的插件做安全加固。
🛠️ 改动
user_name（QQ 昵称，用户可控）等 9 处 SQL 全部改用参数化查询（SQL 用
?占位，由数据库驱动做参数编码），彻底消除注入面get_kv/set_kv/migrate_old_violations的key/value（含群消息原文）改为参数化
get_game/save_game/delete_game的 key/value 改为参数化jn.database.query/exec类型注解，补充「优先参数化、无法参数化时用
jn.sql.escape兜底转义」的用法说明jn.luaSDK 副本✅ 安全影响
jn.sql.escape实际调用，全部改为参数化查询🧪 验证
query/exec参数化支持（见 JuanNiang-Neo 对应 PR）