kvdb/sqlbase: fix non-constant format strings
What the developer wrote
Authored by Alex Akselrod
kvdb/sqlbase: fix non-constant format strings
When updating the Go version in kvdb to >= 1.24, schema.go no
longer compiles due to non-constant format strings. This is
invisible until:
- a new version of kvdb is tagged and imported in consumers
- kvdb is redirected to the local copy
This commit fixes the bug.
What changed, and why it matters
This is a code-compatibility fix, not a security fix. The Go compiler starting with version 1.24 rejects non-constant format strings passed to fmt.Sprintf. The patch changes several fmt.Sprintf calls to use a constant "%s" format string with the actual SQL string as an argument. Without the fix, the package simply fails to compile on newer Go versions. There is no indication this was exploitable or that it fixed a runtime vulnerability.
No security action required. Treat as a normal build-compatibility/maintenance patch. Ensure CI covers the Go version where this issue surfaced.
Security signals we found
No security-relevant signals present in commit message or diff
Change is purely to satisfy Go compiler format-string checks
Generated SQL strings are identical before and after the patch
Evidence from the diff
The commit modifies kvdb/sqlbase/schema.go to satisfy Go 1.24’s stricter vet/build rules that disallow non-constant format strings in fmt.Sprintf. Previously the code concatenated SQL fragments directly into the format-string position (e.g., fmt.Sprintf(CREATE TABLE IF NOT EXISTS + tableInSchema + ...)). The patch wraps those fragments as arguments to a constant “%s” format. The generated SQL is functionally unchanged, so this is a build-time compatibility correction rather than a runtime behavior change or security boundary fix.
Changed components
kvdb/sqlbase/schema.goInspect captured patch +11 / −11
diff --git a/kvdb/sqlbase/schema.go b/kvdb/sqlbase/schema.go
index 1ff3aef..e869446 100644
--- a/kvdb/sqlbase/schema.go
+++ b/kvdb/sqlbase/schema.go
@@ -21,7 +21,7 @@ func newKVSchemaCreationCmd(table, schema string,
)
if schema != "" {
finalCmd = fmt.Sprintf(
- `CREATE SCHEMA IF NOT EXISTS ` + schema + `;`,
+ "%s", `CREATE SCHEMA IF NOT EXISTS `+schema+`;`,
)
tableInSchema = fmt.Sprintf("%s.%s", schema, table)
@@ -44,26 +44,26 @@ func newKVSchemaCreationCmd(table, schema string,
//
// The replacements map can be used to replace any sqlite keywords.
// Callers should note that the sqlite keywords are case-sensitive.
- finalCmd += fmt.Sprintf(`
-CREATE TABLE IF NOT EXISTS ` + tableInSchema + `
+ finalCmd += fmt.Sprintf("%s", `
+CREATE TABLE IF NOT EXISTS `+tableInSchema+`
(
key BLOB NOT NULL,
value BLOB,
parent_id BIGINT,
id INTEGER PRIMARY KEY,
sequence BIGINT,
- CONSTRAINT ` + table + `_parent FOREIGN KEY (parent_id)
- REFERENCES ` + tableInSchema + ` (id)
+ CONSTRAINT `+table+`_parent FOREIGN KEY (parent_id)
+ REFERENCES `+tableInSchema+` (id)
ON UPDATE NO ACTION
ON DELETE CASCADE
);
-CREATE INDEX IF NOT EXISTS ` + table + `_p
- ON ` + tableInSchema + ` (parent_id);
-CREATE UNIQUE INDEX IF NOT EXISTS ` + table + `_up
- ON ` + tableInSchema + `
+CREATE INDEX IF NOT EXISTS `+table+`_p
+ ON `+tableInSchema+` (parent_id);
+CREATE UNIQUE INDEX IF NOT EXISTS `+table+`_up
+ ON `+tableInSchema+`
(parent_id, key) WHERE parent_id IS NOT NULL;
-CREATE UNIQUE INDEX IF NOT EXISTS ` + table + `_unp
- ON ` + tableInSchema + ` (key) WHERE parent_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS `+table+`_unp
+ ON `+tableInSchema+` (key) WHERE parent_id IS NULL;
`)
for from, to := range replacements {
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.