Parameterized queries?

[Cantor, Scott]

> I know the queries I want to make that include values from
> $resolutionContext and would like to make sure they are safe
> from SQL injection.

An IdP isn't usually leveraging data from an untrusted source unless the deployer makes some questionable decisions, so that's usually not a huge concern apart from maybe some escaping if it comes up, and it rarely has (never in my case).

If source data is that dirty, that's a pretty unusual scenario as a rule, but proxying is probably a scenario where the issues get trickier (and that is a feature developed much later than the resolver was).

Also note that your data connection ought to be read only, so that limits the risk a lot as well.

> I'm not familiar with how to do that within attribute
>-resolver.xml. Is there some documentation or example you
> could point me too?

There's no generic answer, it would probably require some Java code to do some escaping, and/or using scripts to clean up data before it ends up in the query so the data connector would be layered on another set of dependencies that had undergone whatever cleanup was needed.

Montana is a consortium member (thank you!), so I will send you the contact for getting Slack or Jira access separately if you wish to get additional help that way.

-- Scott