@saltcorn/data: Tenant user role is used for tenant creation role check
## Summary
When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can simply append `/tenant/create` to their tenant URL. The system reads the role from the tenant context (admin), and a new tenant is created on the **root domain** (in `PUBLIC SCHEMA > _sc_tenants`), rather than in the tenant's own `_sc_tenants` table.
If the same logic applies to other routes, a tenant admin effectively gains admin rights on the root domain.
## PoC
A tenant-created subtenant appears under the Saltcorn public schema instead of the tenant's own schema.
- Even when `role_id=1` is req
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler
## Summary
The `jsexprToSQL()` function in Saltcorn converts JavaScript expressions to SQL for use in database constraints. The `Literal` handler wraps string values in single quotes without escaping embedded single quotes, allowing SQL injection when creating Formula-type table constraints.
## Vulnerable Component
**File:** `packages/saltcorn-data/models/expression.ts`, lines 117-118
```typescript
Literal({ value }: { value: ExtendedNode }) {
if (typeof value == "string") return `'${value}'`; // NO ESCAPING!
return `${value}`;
},
```
**Call chain:** Formula constraint creation → `table_constraints.ts:127` → `jsexprToSQL()` → `Lite