sql query param refact

Author: prkhrkat

pkg/auth/user/repository/DefaultAuthPolicyRepository.go

@@ -70,15 +70,18 @@ func (impl DefaultAuthPolicyRepositoryImpl) UpdatePolicyByRoleType(policy string
 
 func (impl DefaultAuthPolicyRepositoryImpl) GetPolicyByRoleTypeAndEntity(roleType bean.RoleType, accessType string, entity string) (policy string, err error) {
 	var model DefaultAuthPolicy
-	query := "SELECT * FROM default_auth_policy WHERE role_type = ? "
-	query += " and entity = '" + entity + "' "
+	var queryParams []interface{}
+	query := "SELECT * FROM default_auth_policy WHERE role_type = ? AND entity = ? "
+	queryParams = append(queryParams, roleType, entity)
+
 	if accessType == "" {
-		query += "and access_type IS NULL ;"
+		query += "AND access_type IS NULL ;"
 	} else {
-		query += "and access_type ='" + accessType + "' ;"
+		query += "AND access_type = ? ;"
+		queryParams = append(queryParams, accessType)
 	}
 
-	_, err = impl.dbConnection.Query(&model, query, roleType)
+	_, err = impl.dbConnection.Query(&model, query, queryParams...)
 	if err != nil {
 		impl.logger.Error("error in getting policy by roleType", "err", err, "roleType", roleType, "entity", entity)
 		return "", err

pkg/genericNotes/repository/GenericNoteRepository.go

@@ -17,9 +17,7 @@
 package repository
 
 import (
-	"fmt"
 	repository1 "github.com/devtron-labs/devtron/internal/sql/repository/app"
-	"github.com/devtron-labs/devtron/internal/sql/repository/helper"
 	"github.com/devtron-labs/devtron/pkg/sql"
 	"github.com/go-pg/pg"
 )
@@ -108,9 +106,8 @@ func (impl GenericNoteRepositoryImpl) GetDescriptionFromAppIds(appIds []int) ([]
 	if len(appIds) == 0 {
 		return nil, nil
 	}
-	query := fmt.Sprintf("SELECT * "+
-		"FROM app WHERE id IN (%s)", helper.GetCommaSepratedString(appIds))
-	_, err := impl.dbConnection.Query(&apps, query)
+	// Use parameterized query to prevent SQL injection
+	err := impl.dbConnection.Model(&apps).Where("id IN (?)", pg.In(appIds)).Select()
 	if err != nil {
 		return nil, err
 	}