Skip to content

Conversation

@RinZ27
Copy link

@RinZ27 RinZ27 commented Feb 1, 2026

I noticed that the 'latest_n' parameter was being directly interpolated into the SQL query strings in 'LTMSQLiteStorage'. While it's expected to be an integer, casting it explicitly to 'int' ensures that no malicious strings can be injected into the 'LIMIT' clause, especially in an AI agent context where input sources can be unpredictable. This also allows for better error handling if an invalid type is passed.


Note

Medium Risk
Low-impact security hardening, but it changes runtime behavior by raising on non-numeric latest_n (not currently caught by the existing sqlite-only exception handling).

Overview
Security hardening: LTMSQLiteStorage.load and LTMSQLiteStorage.aload now cast latest_n to int before interpolating it into the SQL LIMIT clause, reducing the risk of injection through an unexpected/non-integer value.

This may surface new failures for invalid latest_n inputs (e.g., ValueError) rather than silently executing a query.

Written by Cursor Bugbot for commit 7fe4020. This will update automatically on new commits. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant