From 2f956b7eb3d5eb2de3e79d7df2c87405af25071e Mon Sep 17 00:00:00 2001 From: Deepak Rai Date: Fri, 4 Nov 2022 23:26:55 +0530 Subject: [PATCH] fix: changed query to accept user input in prepared sql statement (#2652) * Changed query to accept user input in prepared sql statement * Changed query to accept user input in parameterized query * Changed query to accept user input in parameterized query * Changed query to accept user input in parameterized query * Changed query to accept user input in parameterized query --- warehouse/warehouse.go | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/warehouse/warehouse.go b/warehouse/warehouse.go index 79cba136e1..3395403e81 100644 --- a/warehouse/warehouse.go +++ b/warehouse/warehouse.go @@ -1794,6 +1794,7 @@ func pendingEventsHandler(w http.ResponseWriter, r *http.Request) { } func getPendingStagingFileCount(sourceOrDestId string, isSourceId bool) (fileCount int64, err error) { + sourceOrDestId = pq.QuoteIdentifier(sourceOrDestId) sourceOrDestColumn := "" if isSourceId { sourceOrDestColumn = "source_id" @@ -1807,16 +1808,14 @@ func getPendingStagingFileCount(sourceOrDestId string, isSourceId bool) (fileCou FROM %[1]s WHERE - %[1]s.%[3]s = '%[2]s'; + %[2]s = $1; `, warehouseutils.WarehouseUploadsTable, - sourceOrDestId, sourceOrDestColumn, ) - - err = dbHandle.QueryRow(sqlStatement).Scan(&lastStagingFileIDRes) + err = dbHandle.QueryRow(sqlStatement, sourceOrDestId).Scan(&lastStagingFileIDRes) if err != nil && err != sql.ErrNoRows { - err = fmt.Errorf("query: %s failed with Error : %w", sqlStatement, err) + err = fmt.Errorf("query: %s run failed with Error : %w", sqlStatement, err) return } lastStagingFileID := int64(0) @@ -1830,18 +1829,16 @@ func getPendingStagingFileCount(sourceOrDestId string, isSourceId bool) (fileCou FROM %[1]s WHERE - %[1]s.id > %[2]v - AND %[1]s.%[4]s = '%[3]s'; + id > %[2]v + AND %[3]s = $1; `, warehouseutils.WarehouseStagingFilesTable, lastStagingFileID, - sourceOrDestId, sourceOrDestColumn, ) - - err = dbHandle.QueryRow(sqlStatement).Scan(&fileCount) + err = dbHandle.QueryRow(sqlStatement, sourceOrDestId).Scan(&fileCount) if err != nil && err != sql.ErrNoRows { - err = fmt.Errorf("query: %s failed with Error : %w", sqlStatement, err) + err = fmt.Errorf("query: %s run failed with Error : %w", sqlStatement, err) return }