mirror of
https://github.com/NicolasBohn/NexQuant.git
synced 2026-07-27 23:47:46 +00:00
a910d70d40
The metric parameter was passed directly into an f-string SQL query. Add explicit validation against _ALLOWED_METRICS before use, raising ValueError on unknown values. Raises ValueError on injection attempt instead of silently accepting arbitrary column names. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>