GHSA-59g6-v3vg-f7wc CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

• PyPI cocoindex: < 0.3.34 → fixed in 0.3.34

Impact The Doris target connector didn't verify the configured table name before creating some SQL statements (`ALTER TABLE`). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. Patches Yes, it's fixed in cocoindex 0.3.34: we start to validate table names passed to Doris target at entry point and error out immediately if it's not a valid identifier. Workarounds Users should make sure table names used to configure CocoIndex targets are valid, regardless of this fix. Which means • The table name comes from a trusted source (e.g. for most cases it's just a fixed string literal). • Even if it comes from an untrusted source (e.g. provided by end user), it should be validated before using it to configure the Doris target for CocoIndex.