wambosec/csi-sqli-rl huggingface dataset:
Security advisory GHSA-5hq7-j5wq-p227: feathers-sequelize vulnerable to SQL injection due to improper parameter filtering
Package: feathers-sequelize (npm), vulnerable version: 6.3.3, fixed in: 6.3.4
CWE: CWE-89
Files changed by the fix:
lib/index.js

Fix diff:
diff --git a/lib/index.js b/lib/index.js
index ad1d760..a034d5e 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -133,7 +133,7 @@ class Service extends AdapterService {
     }, params.sequelize);
 
     if (filters.$select) {
-      q.attributes = filters.$select;
+      q.attributes = filters.$select.map(select => `${select}`);
     }
 
     const Model = this.applyScope(params);
diff --git a/test/index.test.js b/test/index.test.js
index 896c617..6f95af6 100644
--- a/test/index.test.js
+++ b/test/index.test.js
@@ -293,6 +293,12 @@ describe('Feathers Sequelize Service', () => {
         await people.remove(person.id);
       });
 
+      it('does not allow raw attribute $select ', async () => {
+        await assert.rejects(() => people.find({
+          query: { $select: [['(sqlite_version())', 'x']] }
+        }));
+      });
+
       it('hides the Sequelize error in ERROR symbol', async () => {
         try {
           await people.create({
Security advisory GHSA-5r62-mjf5-xwhj: Apache Airflow Common SQL Provider Vulnerable to SQL Injection
Package: apache-airflow-providers-common-sql (pypi), vulnerable version: 1.24.0, fixed in: 1.24.1
CWE: CWE-89
Files changed by the fix:
providers/common/sql/src/airflow/providers/common/sql/operators/sql.py

Fix diff:
diff --git a/providers/common/sql/src/airflow/providers/common/sql/operators/sql.py b/providers/common/sql/src/airflow/providers/common/sql/operators/sql.py
index 9881906dd2e92..2b20b1ee6bc0b 100644
--- a/providers/common/sql/src/airflow/providers/common/sql/operators/sql.py
+++ b/providers/common/sql/src/airflow/providers/common/sql/operators/sql.py
@@ -478,7 +478,7 @@ def __init__(
 
         self.table = table
         self.column_mapping = column_mapping
-        self.partition_clause = partition_clause
+        self.partition_clause = _initialize_partition_clause(partition_clause)
         self.accept_none = accept_none
 
         def _build_checks_sql():
@@ -699,7 +699,7 @@ def __init__(
 
         self.table = table
         self.checks = checks
-        self.partition_clause = partition_clause
+        self.partition_clause = _initialize_partition_clause(partition_clause)
         self.sql = f"SELECT check_name, check_result FROM ({self._generate_sql_query()}) AS check_table"
 
     def execute(self, context: Context):
@@ -1243,3 +1243,14 @@ def execute(self, context: Context):
 
         # TODO(potiuk) remove the type ignore once we solve provider <-> Task SDK relationship
         self.skip_all_except(context["ti"], follow_branch)  # type: ignore[arg-type]
+
+
+def _initialize_partition_clause(clause: str | None) -> str | None:
+    """Ensure the partition_clause contains only valid patterns."""
+    if clause is None:
+        return None
+
+    if ";" in clause:
+        raise ValueError("Invalid partition_clause: semicolons (;) not allowed.")
+
+    return clause
Security advisory GHSA-68wg-qv6r-j4vp: SQL Injection in usmanhalalit/pixie
Package: usmanhalalit/pixie (composer), vulnerable version: 1.0.2, fixed in: 1.0.3
CWE: CWE-89
Files changed by the fix:
src/Pixie/QueryBuilder/Adapters/BaseAdapter.php

Fix diff:
diff --git a/README.md b/README.md
index 039b9bc..caba054 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ The syntax is quite similar to Laravel's query builder.
 require 'vendor/autoload.php';
 
 // Create a connection, once only.
-$config = array(
+$config = [
             'driver'    => 'mysql', // Db driver
             'host'      => 'localhost',
             'database'  => 'your-database',
@@ -29,11 +29,11 @@ $config = array(
             'charset'   => 'utf8', // Optional
             'collation' => 'utf8_unicode_ci', // Optional
             'prefix'    => 'cb_', // Table prefix, optional
-            'options'   => array( // PDO constructor options, optional
+            'options'   => [ // PDO constructor options, optional
                 PDO::ATTR_TIMEOUT => 5,
                 PDO::ATTR_EMULATE_PREPARES => false,
-            ),
-        );
+            ],
+        ];
 
 new \Pixie\Connection('mysql', $config, 'QB');
 ```
@@ -659,4 +659,4 @@ Here are some cases where Query Events can be extremely helpful:
 ___
 If you find any typo then please edit and send a pull request.
 
-&copy; 2016 [Muhammad Usman](http://usman.it/). Licensed under MIT license.
+&copy; 2020 [Muhammad Usman](http://usman.it/). Licensed under MIT license.
diff --git a/src/Pixie/QueryBuilder/Adapters/BaseAdapter.php b/src/Pixie/QueryBuilder/Adapters/BaseAdapter.php
index 5b1e0a4..d6248c1 100644
--- a/src/Pixie/QueryBuilder/Adapters/BaseAdapter.php
+++ b/src/Pixie/QueryBuilder/Adapters/BaseAdapter.php
@@ -65,8 +65,8 @@ public function select($statements)
         }
 
         // Limit and offset
-        $limit = isset($statements['limit']) ? 'LIMIT ' . $statements['limit'] : '';
-        $offset = isset($statements['offset']) ? 'OFFSET ' . $statements['offset'] : '';
+        $limit = isset($statements['limit']) ? 'LIMIT ' . (int) $statements['limit'] : '';
+        $offset = isset($statements['offset']) ? 'OFFSET ' . (int) $statements['offset'] : '';
 
         // Having
         list($havingCriteria, $havingBindings) = $this->buildCriteriaWithType($statements, 'havings', 'HAVING');
Security advisory GHSA-6927-3vr9-fxf2: ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
Package: parse-server (npm), vulnerable version: 6.4.0, fixed in: 6.5.0
CWE: CWE-89
Files changed by the fix:
src/Adapters/Storage/Postgres/PostgresStorageAdapter.js

Fix diff:
diff --git a/spec/vulnerabilities.spec.js b/spec/vulnerabilities.spec.js
index c499eb015f..d6c7971cad 100644
--- a/spec/vulnerabilities.spec.js
+++ b/spec/vulnerabilities.spec.js
@@ -459,3 +459,28 @@ describe('Vulnerabilities', () => {
     });
   });
 });
+
+describe('Postgres regex sanitizater', () => {
+  it('sanitizes the regex correctly to prevent Injection', async () => {
+    const user = new Parse.User();
+    user.set('username', 'username');
+    user.set('password', 'password');
+    user.set('email', 'email@example.com');
+    await user.signUp();
+
+    const response = await request({
+      method: 'GET',
+      url:
+        "http://localhost:8378/1/classes/_User?where[username][$regex]=A'B'%3BSELECT+PG_SLEEP(3)%3B--",
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+      },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.data.results).toEqual(jasmine.any(Array));
+    expect(response.data.results.length).toBe(0);
+  });
+});
diff --git a/src/Adapters/Storage/Postgres/PostgresStorageAdapter.js b/src/Adapters/Storage/Postgres/PostgresStorageAdapter.js
index 3ad59ec77f..efbe985bf9 100644
--- a/src/Adapters/Storage/Postgres/PostgresStorageAdapter.js
+++ b/src/Adapters/Storage/Postgres/PostgresStorageAdapter.js
@@ -2656,7 +2656,7 @@ function literalizeRegexPart(s: string) {
     .replace(/([^\\])(\\Q)/, '$1')
     .replace(/^\\E/, '')
     .replace(/^\\Q/, '')
-    .replace(/([^'])'/, `$1''`)
+    .replace(/([^'])'/g, `$1''`)
     .replace(/^'([^'])/, `''$1`);
 }
Security advisory GHSA-69c3-5xxf-58q2: SQL injection in moodle
Package: moodle/moodle (composer), vulnerable version: v4.0.0, fixed in: 4.0.1
CWE: CWE-89
Files changed by the fix:
badges/criteria/award_criteria_profile.php

Fix diff:
diff --git a/badges/criteria/award_criteria_profile.php b/badges/criteria/award_criteria_profile.php
index d3ac2f25556f8..d1f30961535d6 100644
--- a/badges/criteria/award_criteria_profile.php
+++ b/badges/criteria/award_criteria_profile.php
@@ -202,8 +202,8 @@ public function review($userid, $filtered = false) {
                 $join .= " LEFT JOIN {user_info_data} uid{$idx} ON uid{$idx}.userid = u.id AND uid{$idx}.fieldid = :fieldid{$idx} ";
                 $sqlparams["fieldid{$idx}"] = $param['field'];
                 $whereparts[] = "uid{$idx}.id IS NOT NULL";
-            } else {
-                // This is a field from {user} table.
+            } else if (in_array($param['field'], $this->allowed_default_fields)) {
+                // This is a valid field from {user} table.
                 if ($param['field'] == 'picture') {
                     // The picture field is numeric and requires special handling.
                     $whereparts[] = "u.{$param['field']} != 0";
Security advisory GHSA-69wx-xc6j-28v3: Admidio has Blind SQL Injection in ecard_send.php
Package: admidio/admidio (composer), vulnerable version: v4.3.8, fixed in: 4.3.9
CWE: CWE-89
Files changed by the fix:
adm_program/modules/ecards/ecard_send.php

Fix diff:
diff --git a/adm_program/modules/ecards/ecard_send.php b/adm_program/modules/ecards/ecard_send.php
index 1caf05d27b..5536c8c17a 100644
--- a/adm_program/modules/ecards/ecard_send.php
+++ b/adm_program/modules/ecards/ecard_send.php
@@ -92,7 +92,7 @@
             $arrayRoles[] = $roleId;
         }
     } else {
-        $arrayUsers[] = $value;
+        $arrayUsers[] = (int) $value;
     }
 }
Security advisory GHSA-6fvw-x6gw-4wv8: Froxlor SQL injection vulnerability
Package: froxlor/froxlor (composer), vulnerable version: 0.10.29.1, fixed in: 0.10.30
CWE: CWE-89
Files changed by the fix:
lib/Froxlor/Database/Manager/DbManagerMySQL.php

Fix diff:
diff --git a/lib/Froxlor/Database/Manager/DbManagerMySQL.php b/lib/Froxlor/Database/Manager/DbManagerMySQL.php
index bf2f01ca8d..70b6eee4f7 100644
--- a/lib/Froxlor/Database/Manager/DbManagerMySQL.php
+++ b/lib/Froxlor/Database/Manager/DbManagerMySQL.php
@@ -60,7 +60,10 @@ public function __construct(&$log = null)
 	 */
 	public function createDatabase($dbname = null)
 	{
-		Database::query("CREATE DATABASE `" . $dbname . "`");
+		$stmt = Database::prepare("CREATE DATABASE :dbname");
+		Database::pexecute($stmt, [
+			'dbname' => $dbname
+		]);
 	}
 
 	/**
Security advisory GHSA-6g8q-qfpv-57wp: CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection
Package: cakephp/cakephp (composer), vulnerable version: 4.2.11, fixed in: 4.2.12
CWE: CWE-89
Files changed by the fix:
src/Database/Query.php

Fix diff:
diff --git a/src/Database/Query.php b/src/Database/Query.php
index 98f7bbc1e77..e96e246f175 100644
--- a/src/Database/Query.php
+++ b/src/Database/Query.php
@@ -1534,6 +1534,9 @@ public function page(int $num, ?int $limit = null)
      */
     public function limit($limit)
     {
+        if (is_string($limit) && !is_numeric($limit)) {
+            throw new InvalidArgumentException('Invalid value for `limit()`');
+        }
         $this->_dirty();
         $this->_parts['limit'] = $limit;
 
@@ -1560,6 +1563,9 @@ public function limit($limit)
      */
     public function offset($offset)
     {
+        if (is_string($offset) && !is_numeric($offset)) {
+            throw new InvalidArgumentException('Invalid value for `offset()`');
+        }
         $this->_dirty();
         $this->_parts['offset'] = $offset;
 
diff --git a/tests/TestCase/Database/QueryTest.php b/tests/TestCase/Database/QueryTest.php
index 3b80b07bfad..9169a39ac02 100644
--- a/tests/TestCase/Database/QueryTest.php
+++ b/tests/TestCase/Database/QueryTest.php
@@ -2218,6 +2218,32 @@ public function testSelectLimit(): void
         $this->assertCount(2, $result);
     }
 
+    /**
+     * Tests selecting rows with string offset/limit
+     */
+    public function testSelectLimitInvalid(): void
+    {
+        $query = new Query($this->connection);
+        $this->expectException(InvalidArgumentException::class);
+        $query->select('id')->from('comments')
+            ->limit('1 --more')
+            ->order(['id' => 'ASC'])
+            ->execute();
+    }
+
+    /**
+     * Tests selecting rows with string offset/limit
+     */
+    public function testSelectOffsetInvalid(): void
+    {
+        $query = new Query($this->connection);
+        $this->expectException(InvalidArgumentException::class);
+        $query->select('id')->from('comments')
+            ->offset('1 --more')
+            ->order(['id' => 'ASC'])
+            ->execute();
+    }
+
     /**
      * Tests selecting rows combining a limit and offset clause
      */
Security advisory GHSA-6gm7-j668-w6h9: SQL Injection in Pimcore
Package: pimcore/pimcore (composer), vulnerable version: v10.3.4, fixed in: 10.3.5
CWE: CWE-89
Files changed by the fix:
bundles/AdminBundle/Controller/Admin/RecyclebinController.php

Fix diff:
diff --git a/bundles/AdminBundle/Controller/Admin/RecyclebinController.php b/bundles/AdminBundle/Controller/Admin/RecyclebinController.php
index 550a34bdc49..d5d273aefb9 100644
--- a/bundles/AdminBundle/Controller/Admin/RecyclebinController.php
+++ b/bundles/AdminBundle/Controller/Admin/RecyclebinController.php
@@ -119,7 +119,7 @@ public function listAction(Request $request)
                         $condition = $field . ' BETWEEN ' . $db->quote($value) . ' AND ' . $db->quote($maxTime);
                         $conditionFilters[] = $condition;
                     } else {
-                        $conditionFilters[] = $field . $operator . " '" . $value . "' ";
+                        $conditionFilters[] = $field . $operator . ' ' . $db->quote($value);
                     }
                 }
             }
Security advisory GHSA-6mhm-gcpf-5gr8: SQL Injection in Admin Search Find API
Package: pimcore/pimcore (composer), vulnerable version: v10.5.20, fixed in: 10.5.21
CWE: CWE-89
Files changed by the fix:
bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Fix diff:
diff --git a/bundles/AdminBundle/Controller/Searchadmin/SearchController.php b/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
index 5082616b5d6..651548b55ef 100644
--- a/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
+++ b/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
@@ -15,6 +15,7 @@
 
 namespace Pimcore\Bundle\AdminBundle\Controller\Searchadmin;
 
+use Doctrine\DBAL\Exception\SyntaxErrorException;
 use Pimcore\Bundle\AdminBundle\Controller\AdminController;
 use Pimcore\Bundle\AdminBundle\Controller\Traits\AdminStyleTrait;
 use Pimcore\Bundle\AdminBundle\Helper\GridHelperService;
@@ -111,6 +112,8 @@ public function findAction(Request $request, EventDispatcherInterface $eventDisp
         $bricks = [];
         if (!empty($allParams['fields'])) {
             $fields = $allParams['fields'];
+            //remove sql comments
+            $fields = str_replace('--', '', $fields);
 
             foreach ($fields as $f) {
                 $parts = explode('~', $f);
@@ -310,7 +313,11 @@ public function findAction(Request $request, EventDispatcherInterface $eventDisp
             $searcherList = $beforeListLoadEvent->getArgument('list');
         }
 
-        $hits = $searcherList->load();
+        try {
+            $hits = $searcherList->load();
+        } catch (SyntaxErrorException $syntaxErrorException) {
+            throw new \InvalidArgumentException('Check your arguments.');
+        }
 
         $elements = [];
         foreach ($hits as $hit) {
Security advisory GHSA-72hh-xf79-429p: Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()
Package: pimcore/pimcore (composer), vulnerable version: v11.1.0, fixed in: 11.1.1
CWE: CWE-89
Files changed by the fix:
models/DataObject/ClassDefinition/Data/Multiselect.php

Fix diff:
diff --git a/models/DataObject/ClassDefinition/Data/Multiselect.php b/models/DataObject/ClassDefinition/Data/Multiselect.php
index 06af6de4a55..07cda341501 100644
--- a/models/DataObject/ClassDefinition/Data/Multiselect.php
+++ b/models/DataObject/ClassDefinition/Data/Multiselect.php
@@ -302,8 +302,8 @@ public function getFilterConditionExt(mixed $value, string $operator, array $par
             }
 
             $value = $operator === '='
-                ? "'%,".$value.",%'"
-                : "'%,%".$value."%,%'";
+                ? $db->quote("%,". $value . ",%")
+                : $db->quote("%,%" .Helper::escapeLike($value). "%,%");
 
             return $key.' LIKE '.$value.' ';
         }
Security advisory GHSA-753c-phhg-cj29: Madge vulnerable to command injection
Package: madge (npm), vulnerable version: 4.0.0, fixed in: 4.0.1
CWE: CWE-77
CWE-89
Files changed by the fix:
lib/graph.js

Fix diff:
diff --git a/lib/graph.js b/lib/graph.js
index 4e64c650..f25b6f52 100644
--- a/lib/graph.js
+++ b/lib/graph.js
@@ -4,7 +4,7 @@ const path = require('path');
 const {promisify} = require('util');
 const graphviz = require('graphviz');
 
-const exec = promisify(require('child_process').exec);
+const exec = promisify(require('child_process').execFile);
 const writeFile = promisify(require('fs').writeFile);
 
 /**
@@ -22,19 +22,14 @@ function setNodeColor(node, color) {
  * @param  {Object} config
  * @return {Promise}
  */
-function checkGraphvizInstalled(config) {
-	if (config.graphVizPath) {
-		const cmd = path.join(config.graphVizPath, 'gvpr -V');
-		return exec(cmd)
-			.catch(() => {
-				throw new Error('Could not execute ' + cmd);
-			});
-	}
+async function checkGraphvizInstalled(config) {
+	const cmd = config.graphVizPath ? path.join(config.graphVizPath, 'gvpr') : 'gvpr';
 
-	return exec('gvpr -V')
-		.catch((error) => {
-			throw new Error('Graphviz could not be found. Ensure that "gvpr" is in your $PATH.\n' + error);
-		});
+	try {
+		await exec(cmd, ['-V']);
+	} catch (err) {
+		throw new Error(`Graphviz could not be found. Ensure that "gvpr" is in your $PATH. ${err}`);
+	}
 }
 
 /**
diff --git a/test/api.js b/test/api.js
index 8595d253..2afd3f74 100644
--- a/test/api.js
+++ b/test/api.js
@@ -313,7 +313,7 @@ describe('API', () => {
 			madge(__dirname + '/cjs/a.js', {graphVizPath: '/invalid/path'})
 				.then((res) => res.image('image.png'))
 				.catch((err) => {
-					err.message.should.match(/Could not execute .*gvpr \-V/);
+					err.message.should.eql('Graphviz could not be found. Ensure that "gvpr" is in your $PATH. Error: spawn /invalid/path/gvpr ENOENT');
 					done();
 				});
 		});
Security advisory GHSA-78p3-fwcq-62c2: @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution  by manipulating `lang` and  `defstring` parameters when setting localizer strings
Package: @saltcorn/server (npm), vulnerable version: 0.9.8, fixed in: 1.0.0-beta.14
CWE: CWE-1321
Files changed by the fix:
packages/server/routes/infoarch.js

Fix diff:
diff --git a/packages/server/routes/infoarch.js b/packages/server/routes/infoarch.js
index 570f4eba6d80..12303c4cbf4e 100644
--- a/packages/server/routes/infoarch.js
+++ b/packages/server/routes/infoarch.js
@@ -234,7 +234,14 @@ router.post(
   isAdmin,
   error_catcher(async (req, res) => {
     const { lang, defstring } = req.params;
-
+    if (
+      lang === "__proto__" ||
+      defstring === "__proto__" ||
+      lang === "constructor"
+    ) {
+      res.redirect(`/`);
+      return;
+    }
     const cfgStrings = getState().getConfigCopy("localizer_strings");
     if (cfgStrings[lang]) cfgStrings[lang][defstring] = text(req.body.value);
     else cfgStrings[lang] = { [defstring]: text(req.body.value) };
Security advisory GHSA-8hcf-2m4v-f2rq: SQL Injection in liftkit/database
Package: liftkit/database (composer), vulnerable version: v2.13.1, fixed in: 2.13.2
CWE: CWE-89
Files changed by the fix:
src/Query/Query.php

Fix diff:
diff --git a/src/Query/Query.php b/src/Query/Query.php
index 8462cc8..f1580ff 100644
--- a/src/Query/Query.php
+++ b/src/Query/Query.php
@@ -921,7 +921,7 @@ public function groupBy ($field)
 		}
 
 
-		public function orderBy ($field, $direction = 'ASC')
+		public function orderBy ($field, $direction = self::QUERY_ORDER_ASC)
 		{
 			$this->orderBys[] = array(
 				'field'     => $this->filterIdentifier($field),
@@ -1064,7 +1064,11 @@ protected function processOrderBy ()
 				$orderBys = array();
 
 				foreach ($this->orderBys as $orderBy) {
-					$orderBys[] = $orderBy['field'] . ' ' . $orderBy['direction'];
+					$direction = (strtoupper($orderBy['direction']) == self::QUERY_ORDER_DESC)
+						? self::QUERY_ORDER_DESC
+						: self::QUERY_ORDER_ASC;
+
+					$orderBys[] = $orderBy['field'] . ' ' . $direction;
 				}
 
 				return $sql.implode(', ', $orderBys);
Security advisory GHSA-8x27-jwjr-8545: SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
Package: adodb/adodb-php (composer), vulnerable version: v5.22.8, fixed in: 5.22.9
CWE: CWE-89
Files changed by the fix:
drivers/adodb-postgres64.inc.php

Fix diff:
diff --git a/drivers/adodb-postgres64.inc.php b/drivers/adodb-postgres64.inc.php
index b1d161d7c..5cbe77ed2 100644
--- a/drivers/adodb-postgres64.inc.php
+++ b/drivers/adodb-postgres64.inc.php
@@ -138,7 +138,8 @@ function IfNull( $field, $ifNull )
 	// get the last id - never tested
 	function pg_insert_id($tablename,$fieldname)
 	{
-		$result=pg_query($this->_connectionID, 'SELECT last_value FROM '. $tablename .'_'. $fieldname .'_seq');
+		$sequence = pg_escape_identifier($this->_connectionID, $tablename .'_'. $fieldname .'_seq');
+		$result = pg_query($this->_connectionID, 'SELECT last_value FROM '. $sequence);
 		if ($result) {
 			$arr = @pg_fetch_row($result,0);
 			pg_free_result($result);
Security advisory GHSA-92qf-8gh3-gwcm: Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Package: apache-superset (pypi), vulnerable version: 4.0.2, fixed in: 4.1.0
CWE: CWE-89
Files changed by the fix:
superset/config.py

Fix diff:
diff --git a/superset/config.py b/superset/config.py
index fa31fd069a92..4e5f707edd43 100644
--- a/superset/config.py
+++ b/superset/config.py
@@ -1276,7 +1276,16 @@ def CSV_TO_HIVE_UPLOAD_DIRECTORY_FUNC(  # pylint: disable=invalid-name
 # unsafe SQL functions in SQL Lab and Charts. The keys of the dictionary are the engine
 # names, and the values are sets of disallowed functions.
 DISALLOWED_SQL_FUNCTIONS: dict[str, set[str]] = {
-    "postgresql": {"version", "query_to_xml", "inet_server_addr", "inet_client_addr"},
+    "postgresql": {
+        "database_to_xml",
+        "inet_client_addr",
+        "inet_server_addr",
+        "query_to_xml",
+        "query_to_xml_and_xmlschema",
+        "table_to_xml",
+        "table_to_xml_and_xmlschema",
+        "version",
+    },
     "clickhouse": {"url"},
     "mysql": {"version"},
 }