Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix code scanning alert no. 8: Database query built from user-controlled sources #2375

Draft
wants to merge 1 commit into
base: develop
Choose a base branch
from
Draft

Fix code scanning alert no. 8: Database query built from user-controlled sources #2375

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion db/sql/SqlDb.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -498,7 +498,7 @@
}

if orderColumn != "" {
q = q.OrderBy("pe." + orderColumn + " " + orderDirection)
q = q.OrderBy(squirrel.Expr("pe." + orderColumn + " " + orderDirection))

Check failure on line 501 in db/sql/SqlDb.go

View workflow job for this annotation

GitHub Actions / build-local 

cannot use squirrel.Expr("pe." + orderColumn + " " + orderDirection) (value of type squirrel.Sqlizer) as string value in argument to q.OrderBy

Check failure

Code scanning / CodeQL

Database query built from user-controlled sources High

This query depends on a
user-provided value
Loading
.

Copilot Autofix AI about 2 months ago

To fix the problem, we should avoid using string concatenation to build SQL queries with user-provided values. Instead, we should use parameterized queries or the squirrel library's built-in methods to safely include these values in the query.

  • Replace the string concatenation in the OrderBy clause with a safer method.
  • Use squirrel.Expr with placeholders and arguments to safely include the orderColumn and orderDirection values.
Suggested changeset 1
db/sql/SqlDb.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/db/sql/SqlDb.go b/db/sql/SqlDb.go
--- a/db/sql/SqlDb.go
+++ b/db/sql/SqlDb.go
@@ -500,3 +500,3 @@
 	if orderColumn != "" {
-		q = q.OrderBy(squirrel.Expr("pe." + orderColumn + " " + orderDirection))
+		q = q.OrderBy(squirrel.Expr("pe.? ?", squirrel.Expr(orderColumn), orderDirection))
 	}
EOF
@@ -500,3 +500,3 @@
if orderColumn != "" {
q = q.OrderBy(squirrel.Expr("pe." + orderColumn + " " + orderDirection))
q = q.OrderBy(squirrel.Expr("pe.? ?", squirrel.Expr(orderColumn), orderDirection))
}
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
}

query, args, err := q.ToSql()
Expand Down
Loading