Skip to content

Commit f9584fa

Browse files
prkhrkatvikramdevtron
prkhrkat
and
vikramdevtron
authored
misc: Argo version update (#6817)
* vendor update * vendor update * misc: sql query param refacter (#6810) * sql query param refact * sql query param refact * argo-cd version fix * argo-cd version fix * argo-cd version fix * docker version --------- Co-authored-by: Vikram Singh <[email protected]> Co-authored-by: Vikram <[email protected]>
2 parents 49080ab + 7eb86d1 commit f9584fa

File tree

17 files changed

+191
-90
lines changed

17 files changed

+191
-90
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.24.0 AS build-env
1+
FROM golang:1.24.6 AS build-env
22

33
RUN echo $GOPATH && \
44
apt update && \

‎DockerfileEA‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.24.0 AS build-env
1+
FROM golang:1.24.6 AS build-env
22

33
RUN echo $GOPATH && \
44
apt update && \

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
module github.com/devtron-labs/devtron
22

3-
go 1.24.0
3+
go 1.24.6
44

5-
toolchain go1.24.2
5+
toolchain go1.24.7
66

77
require (
88
github.com/Masterminds/semver v1.5.0
99
github.com/Pallinder/go-randomdata v1.2.0
10-
github.com/argoproj/argo-cd/v2 v2.14.13
10+
github.com/argoproj/argo-cd/v2 v2.14.17
1111
github.com/argoproj/argo-workflows/v3 v3.5.13
1212
github.com/argoproj/gitops-engine v0.7.1-0.20250521000818-c08b0a72c1f1
1313
github.com/aws/aws-sdk-go v1.55.7

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@ github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6
118118
github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
119119
github.com/argoproj/argo-cd/v2 v2.14.13 h1:oSLPHV9Gon6mEqVkyBOuLJ7T16ShZv6xSjkCiquzEDM=
120120
github.com/argoproj/argo-cd/v2 v2.14.13/go.mod h1:P72XxcRigWQpQsuAgaXyHPFYkSPE4sdACA5g/s3Si1I=
121+
github.com/argoproj/argo-cd/v2 v2.14.17 h1:r/CkYKzHoPjGgJ/4/fdubUVpG+LBj6AtOigbitNHgy4=
122+
github.com/argoproj/argo-cd/v2 v2.14.17/go.mod h1:CF9GX0CjKiszpAnvYNCLV5tLSVqgfOgn/tcOt2VHTQo=
121123
github.com/argoproj/gitops-engine v0.7.1-0.20250521000818-c08b0a72c1f1 h1:Ze4U6kV49vSzlUBhH10HkO52bYKAIXS4tHr/MlNDfdU=
122124
github.com/argoproj/gitops-engine v0.7.1-0.20250521000818-c08b0a72c1f1/go.mod h1:WsnykM8idYRUnneeT31cM/Fq/ZsjkefCbjiD8ioCJkU=
123125
github.com/argoproj/pkg v0.13.7-0.20230627120311-a4dd357b057e h1:kuLQvJqwwRMQTheT4MFyKVM8Txncu21CHT4yBWUl1Mk=

‎internal/sql/repository/AppListingRepository.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,9 +197,9 @@ func (impl *AppListingRepositoryImpl) FetchJobsLastSucceededOn(CiPipelineIDs []i
197197
if len(CiPipelineIDs) == 0 {
198198
return lastSucceededTimeArray, nil
199199
}
200-
jobsLastFinishedOnQuery := impl.appListingRepositoryQueryBuilder.JobsLastSucceededOnTimeQuery(CiPipelineIDs)
200+
jobsLastFinishedOnQuery, queryParams := impl.appListingRepositoryQueryBuilder.JobsLastSucceededOnTimeQuery(CiPipelineIDs)
201201
impl.Logger.Debugw("basic app detail query: ", jobsLastFinishedOnQuery)
202-
_, appsErr := impl.dbConnection.Query(&lastSucceededTimeArray, jobsLastFinishedOnQuery)
202+
_, appsErr := impl.dbConnection.Query(&lastSucceededTimeArray, jobsLastFinishedOnQuery, queryParams...)
203203
if appsErr != nil {
204204
impl.Logger.Errorw("error in fetching lastSucceededTimeArray", "error", appsErr, jobsLastFinishedOnQuery)
205205
return lastSucceededTimeArray, appsErr

‎internal/sql/repository/CiArtifactRepository.go‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ package repository
1919
import (
2020
"encoding/json"
2121
"fmt"
22-
"github.com/devtron-labs/devtron/internal/sql/repository/helper"
2322
"github.com/devtron-labs/devtron/pkg/sql"
2423
"github.com/devtron-labs/devtron/util"
2524
"golang.org/x/exp/slices"
@@ -419,9 +418,9 @@ func (impl CiArtifactRepositoryImpl) GetLatestArtifactTimeByCiPipelineIds(ciPipe
419418
"(SELECT pipeline_id, MAX(created_on) created_on " +
420419
"FROM ci_artifact " +
421420
"GROUP BY pipeline_id) cws " +
422-
"where cws.pipeline_id IN (" + helper.GetCommaSepratedString(ciPipelineIds) + "); "
421+
"where cws.pipeline_id IN (?); "
423422

424-
_, err := impl.dbConnection.Query(&artifacts, query)
423+
_, err := impl.dbConnection.Query(&artifacts, query, pg.In(ciPipelineIds))
425424
if err != nil {
426425
return nil, err
427426
}
@@ -779,8 +778,8 @@ func (impl CiArtifactRepositoryImpl) FindArtifactByListFilter(listingFilterOptio
779778
var ciArtifactsResp []CiArtifactWithExtraData
780779
ciArtifacts := make([]*CiArtifact, 0)
781780
totalCount := 0
782-
finalQuery := BuildQueryForArtifactsForCdStage(*listingFilterOptions)
783-
_, err := impl.dbConnection.Query(&ciArtifactsResp, finalQuery)
781+
finalQuery, queryParams := BuildQueryForArtifactsForCdStage(*listingFilterOptions)
782+
_, err := impl.dbConnection.Query(&ciArtifactsResp, finalQuery, queryParams...)
784783
if err == pg.ErrNoRows || len(ciArtifactsResp) == 0 {
785784
return ciArtifacts, totalCount, nil
786785
}
@@ -821,8 +820,8 @@ func (impl CiArtifactRepositoryImpl) FindArtifactByListFilter(listingFilterOptio
821820
func (impl CiArtifactRepositoryImpl) FetchArtifactsByCdPipelineIdV2(listingFilterOptions bean.ArtifactsListFilterOptions) ([]CiArtifactWithExtraData, int, error) {
822821
var wfrList []CiArtifactWithExtraData
823822
totalCount := 0
824-
finalQuery := BuildQueryForArtifactsForRollback(listingFilterOptions)
825-
_, err := impl.dbConnection.Query(&wfrList, finalQuery)
823+
finalQuery, queryParams := BuildQueryForArtifactsForRollback(listingFilterOptions)
824+
_, err := impl.dbConnection.Query(&wfrList, finalQuery, queryParams...)
826825
if err != nil && err != pg.ErrNoRows {
827826
impl.logger.Errorw("error in getting Wfrs and ci artifacts by pipelineId", "err", err, "pipelineId", listingFilterOptions.PipelineId)
828827
return nil, totalCount, err

‎internal/sql/repository/CiArtifactsListingQueryBuilder.go‎

Lines changed: 84 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ package repository
1919
import (
2020
"fmt"
2121
"github.com/devtron-labs/devtron/api/bean"
22-
"github.com/devtron-labs/devtron/internal/sql/repository/helper"
2322
"github.com/go-pg/pg"
2423
)
2524

@@ -28,7 +27,7 @@ const EmptyLikeRegex = "%%"
2827
func BuildQueryForParentTypeCIOrWebhook(listingFilterOpts bean.ArtifactsListFilterOptions) (string, []interface{}) {
2928
commonPaginatedQueryPart, commonPaginatedQueryParams := " cia.image LIKE ?", []interface{}{listingFilterOpts.SearchString}
3029
orderByClause := " ORDER BY cia.id DESC"
31-
limitOffsetQueryPart, limitOffsetQueryParams := fmt.Sprintf(" LIMIT ? OFFSET ?"), []interface{}{listingFilterOpts.Limit, listingFilterOpts.Offset}
30+
limitOffsetQueryPart, limitOffsetQueryParams := " LIMIT ? OFFSET ?", []interface{}{listingFilterOpts.Limit, listingFilterOpts.Offset}
3231
finalQuery := ""
3332
var finalQueryParams []interface{}
3433
var remainingQueryParams []interface{}
@@ -71,82 +70,123 @@ func BuildQueryForParentTypeCIOrWebhook(listingFilterOpts bean.ArtifactsListFilt
7170
return finalQuery, finalQueryParams
7271
}
7372

74-
func BuildQueryForArtifactsForCdStage(listingFilterOptions bean.ArtifactsListFilterOptions) string {
73+
func BuildQueryForArtifactsForCdStage(listingFilterOptions bean.ArtifactsListFilterOptions) (string, []interface{}) {
7574
// expected result -> will fetch all successfully deployed artifacts ar parent stage plus its own stage. Along with this it will
7675
// also fetch all artifacts generated by plugin at pre_cd or post_cd process (will use data_source in ci artifact table for this)
7776

7877
if listingFilterOptions.UseCdStageQueryV2 {
7978
return buildQueryForArtifactsForCdStageV2(listingFilterOptions)
8079
}
8180

81+
var queryParams []interface{}
82+
8283
commonQuery := " from ci_artifact LEFT JOIN cd_workflow ON ci_artifact.id = cd_workflow.ci_artifact_id" +
8384
" LEFT JOIN cd_workflow_runner ON cd_workflow_runner.cd_workflow_id=cd_workflow.id " +
8485
" Where (((cd_workflow_runner.id in (select MAX(cd_workflow_runner.id) OVER (PARTITION BY cd_workflow.ci_artifact_id) FROM cd_workflow_runner inner join cd_workflow on cd_workflow.id=cd_workflow_runner.cd_workflow_id))" +
85-
" AND ((cd_workflow.pipeline_id= %v and cd_workflow_runner.workflow_type = '%v' ) OR (cd_workflow.pipeline_id = %v AND cd_workflow_runner.workflow_type = '%v' AND cd_workflow_runner.status IN ('Healthy','Succeeded') )))" +
86-
" OR (ci_artifact.component_id = %v and ci_artifact.data_source= '%v' ))" +
87-
" AND (ci_artifact.image LIKE '%v' )"
86+
" AND ((cd_workflow.pipeline_id = ? and cd_workflow_runner.workflow_type = ?) OR (cd_workflow.pipeline_id = ? AND cd_workflow_runner.workflow_type = ? AND cd_workflow_runner.status IN ('Healthy','Succeeded') )))" +
87+
" OR (ci_artifact.component_id = ? and ci_artifact.data_source = ?))" +
88+
" AND (ci_artifact.image LIKE ?)"
89+
90+
queryParams = append(queryParams,
91+
listingFilterOptions.PipelineId,
92+
listingFilterOptions.StageType,
93+
listingFilterOptions.ParentId,
94+
listingFilterOptions.ParentStageType,
95+
listingFilterOptions.ParentId,
96+
listingFilterOptions.PluginStage,
97+
listingFilterOptions.SearchString)
8898

89-
commonQuery = fmt.Sprintf(commonQuery, listingFilterOptions.PipelineId, listingFilterOptions.StageType, listingFilterOptions.ParentId, listingFilterOptions.ParentStageType, listingFilterOptions.ParentId, listingFilterOptions.PluginStage, listingFilterOptions.SearchString)
9099
if len(listingFilterOptions.ExcludeArtifactIds) > 0 {
91-
commonQuery = commonQuery + fmt.Sprintf(" AND ( ci_artifact.id NOT IN (%v))", helper.GetCommaSepratedString(listingFilterOptions.ExcludeArtifactIds))
100+
commonQuery += " AND ci_artifact.id NOT IN (?)"
101+
queryParams = append(queryParams, pg.In(listingFilterOptions.ExcludeArtifactIds))
92102
}
93103

94104
totalCountQuery := "SELECT COUNT(DISTINCT ci_artifact.id) as total_count " + commonQuery
95-
selectQuery := fmt.Sprintf("SELECT DISTINCT(ci_artifact.id) , (%v) ", totalCountQuery)
96-
//GroupByQuery := " GROUP BY cia.id "
97-
limitOffSetQuery := fmt.Sprintf(" order by ci_artifact.id desc LIMIT %v OFFSET %v", listingFilterOptions.Limit, listingFilterOptions.Offset)
105+
selectQuery := "SELECT DISTINCT(ci_artifact.id), (" + totalCountQuery + ") "
106+
limitOffSetQuery := " order by ci_artifact.id desc LIMIT ? OFFSET ?"
107+
108+
// Duplicate queryParams for the subquery
109+
finalQueryParams := append(queryParams, queryParams...)
110+
finalQueryParams = append(finalQueryParams, listingFilterOptions.Limit, listingFilterOptions.Offset)
98111

99-
//finalQuery := selectQuery + commonQuery + GroupByQuery + limitOffSetQuery
100112
finalQuery := selectQuery + commonQuery + limitOffSetQuery
101-
return finalQuery
113+
return finalQuery, finalQueryParams
102114
}
103115

104-
func buildQueryForArtifactsForCdStageV2(listingFilterOptions bean.ArtifactsListFilterOptions) string {
105-
whereCondition := fmt.Sprintf(" WHERE (id IN ("+
106-
" SELECT DISTINCT(cd_workflow.ci_artifact_id) as ci_artifact_id "+
107-
" FROM cd_workflow_runner"+
108-
" INNER JOIN cd_workflow ON cd_workflow.id = cd_workflow_runner.cd_workflow_id "+
109-
" AND (cd_workflow.pipeline_id = %d OR cd_workflow.pipeline_id = %d)"+
110-
" WHERE ("+
111-
" (cd_workflow.pipeline_id = %d AND cd_workflow_runner.workflow_type = '%s')"+
112-
" OR"+
113-
" (cd_workflow.pipeline_id = %d"+
114-
" AND cd_workflow_runner.workflow_type = '%s'"+
115-
" AND cd_workflow_runner.status IN ('Healthy','Succeeded')"+
116-
" )"+
117-
" ) ) ", listingFilterOptions.PipelineId, listingFilterOptions.ParentId, listingFilterOptions.PipelineId, listingFilterOptions.StageType, listingFilterOptions.ParentId, listingFilterOptions.ParentStageType)
118-
119-
whereCondition = fmt.Sprintf(" %s OR (ci_artifact.component_id = %d AND ci_artifact.data_source= '%s' ))", whereCondition, listingFilterOptions.ParentId, listingFilterOptions.PluginStage)
116+
func buildQueryForArtifactsForCdStageV2(listingFilterOptions bean.ArtifactsListFilterOptions) (string, []interface{}) {
117+
var queryParams []interface{}
118+
119+
whereCondition := " WHERE (id IN (" +
120+
" SELECT DISTINCT(cd_workflow.ci_artifact_id) as ci_artifact_id " +
121+
" FROM cd_workflow_runner" +
122+
" INNER JOIN cd_workflow ON cd_workflow.id = cd_workflow_runner.cd_workflow_id " +
123+
" AND (cd_workflow.pipeline_id = ? OR cd_workflow.pipeline_id = ?)" +
124+
" WHERE (" +
125+
" (cd_workflow.pipeline_id = ? AND cd_workflow_runner.workflow_type = ?)" +
126+
" OR" +
127+
" (cd_workflow.pipeline_id = ?" +
128+
" AND cd_workflow_runner.workflow_type = ?" +
129+
" AND cd_workflow_runner.status IN ('Healthy','Succeeded')" +
130+
" )" +
131+
" ) ) "
132+
133+
queryParams = append(queryParams,
134+
listingFilterOptions.PipelineId,
135+
listingFilterOptions.ParentId,
136+
listingFilterOptions.PipelineId,
137+
listingFilterOptions.StageType,
138+
listingFilterOptions.ParentId,
139+
listingFilterOptions.ParentStageType)
140+
141+
whereCondition += " OR (ci_artifact.component_id = ? AND ci_artifact.data_source = ?))"
142+
queryParams = append(queryParams, listingFilterOptions.ParentId, listingFilterOptions.PluginStage)
143+
120144
if listingFilterOptions.SearchString != EmptyLikeRegex {
121-
whereCondition = whereCondition + fmt.Sprintf(" AND ci_artifact.image LIKE '%s' ", listingFilterOptions.SearchString)
145+
whereCondition += " AND ci_artifact.image LIKE ?"
146+
queryParams = append(queryParams, listingFilterOptions.SearchString)
122147
}
148+
123149
if len(listingFilterOptions.ExcludeArtifactIds) > 0 {
124-
whereCondition = whereCondition + fmt.Sprintf(" AND ( ci_artifact.id NOT IN (%s))", helper.GetCommaSepratedString(listingFilterOptions.ExcludeArtifactIds))
150+
whereCondition += " AND ci_artifact.id NOT IN (?)"
151+
queryParams = append(queryParams, pg.In(listingFilterOptions.ExcludeArtifactIds))
125152
}
126153

127-
selectQuery := fmt.Sprintf(" SELECT ci_artifact.* ,COUNT(id) OVER() AS total_count " +
128-
" FROM ci_artifact")
129-
ordeyByAndPaginated := fmt.Sprintf(" ORDER BY id DESC LIMIT %d OFFSET %d ", listingFilterOptions.Limit, listingFilterOptions.Offset)
130-
finalQuery := selectQuery + whereCondition + ordeyByAndPaginated
131-
return finalQuery
154+
selectQuery := " SELECT ci_artifact.*, COUNT(id) OVER() AS total_count FROM ci_artifact"
155+
orderByAndPaginated := " ORDER BY id DESC LIMIT ? OFFSET ?"
156+
queryParams = append(queryParams, listingFilterOptions.Limit, listingFilterOptions.Offset)
157+
158+
finalQuery := selectQuery + whereCondition + orderByAndPaginated
159+
return finalQuery, queryParams
132160
}
133161

134-
func BuildQueryForArtifactsForRollback(listingFilterOptions bean.ArtifactsListFilterOptions) string {
162+
func BuildQueryForArtifactsForRollback(listingFilterOptions bean.ArtifactsListFilterOptions) (string, []interface{}) {
163+
var queryParams []interface{}
164+
135165
commonQuery := " FROM cd_workflow_runner cdwr " +
136166
" INNER JOIN cd_workflow cdw ON cdw.id=cdwr.cd_workflow_id " +
137167
" INNER JOIN ci_artifact cia ON cia.id=cdw.ci_artifact_id " +
138-
" WHERE cdw.pipeline_id=%v AND cdwr.workflow_type = '%v' "
168+
" WHERE cdw.pipeline_id = ? AND cdwr.workflow_type = ?"
169+
170+
queryParams = append(queryParams, listingFilterOptions.PipelineId, listingFilterOptions.StageType)
139171

140-
commonQuery = fmt.Sprintf(commonQuery, listingFilterOptions.PipelineId, listingFilterOptions.StageType)
141172
if listingFilterOptions.SearchString != EmptyLikeRegex {
142-
commonQuery += fmt.Sprintf(" AND cia.image LIKE '%v' ", listingFilterOptions.SearchString)
173+
commonQuery += " AND cia.image LIKE ?"
174+
queryParams = append(queryParams, listingFilterOptions.SearchString)
143175
}
176+
144177
if len(listingFilterOptions.ExcludeWfrIds) > 0 {
145-
commonQuery = fmt.Sprintf(" %s AND cdwr.id NOT IN (%s)", commonQuery, helper.GetCommaSepratedString(listingFilterOptions.ExcludeWfrIds))
178+
commonQuery += " AND cdwr.id NOT IN (?)"
179+
queryParams = append(queryParams, pg.In(listingFilterOptions.ExcludeWfrIds))
146180
}
181+
147182
totalCountQuery := " SELECT COUNT(cia.id) as total_count " + commonQuery
148183
orderByQuery := " ORDER BY cdwr.id DESC "
149-
limitOffsetQuery := fmt.Sprintf("LIMIT %v OFFSET %v", listingFilterOptions.Limit, listingFilterOptions.Offset)
150-
finalQuery := fmt.Sprintf(" SELECT cdwr.id as cd_workflow_runner_id,cdwr.triggered_by,cdwr.started_on,cia.*,(%s) ", totalCountQuery) + commonQuery + orderByQuery + limitOffsetQuery
151-
return finalQuery
184+
limitOffsetQuery := " LIMIT ? OFFSET ?"
185+
186+
// Duplicate queryParams for the subquery
187+
finalQueryParams := append(queryParams, queryParams...)
188+
finalQueryParams = append(finalQueryParams, listingFilterOptions.Limit, listingFilterOptions.Offset)
189+
190+
finalQuery := " SELECT cdwr.id as cd_workflow_runner_id,cdwr.triggered_by,cdwr.started_on,cia.*,(" + totalCountQuery + ") " + commonQuery + orderByQuery + limitOffsetQuery
191+
return finalQuery, finalQueryParams
152192
}

‎internal/sql/repository/helper/AppListingRepositoryQueryBuilder.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,16 +111,16 @@ func (impl AppListingRepositoryQueryBuilder) OverviewCiPipelineQuery() string {
111111
}
112112

113113
// use this query with atleast 1 cipipeline id
114-
func (impl AppListingRepositoryQueryBuilder) JobsLastSucceededOnTimeQuery(ciPipelineIDs []int) string {
114+
func (impl AppListingRepositoryQueryBuilder) JobsLastSucceededOnTimeQuery(ciPipelineIDs []int) (string, []interface{}) {
115115
// use this query with atleast 1 cipipeline id
116116
query := "select cw.ci_pipeline_id,cw.finished_on " +
117117
"as last_succeeded_on from ci_workflow cw inner join " +
118118
"(SELECT ci_pipeline_id, MAX(finished_on) finished_on " +
119119
"FROM ci_workflow WHERE ci_workflow.status = 'Succeeded'" +
120120
"GROUP BY ci_pipeline_id) cws on cw.ci_pipeline_id = cws.ci_pipeline_id and cw.finished_on = cws.finished_on " +
121-
"where cw.ci_pipeline_id IN (" + GetCommaSepratedString(ciPipelineIDs) + "); "
121+
"where cw.ci_pipeline_id IN (?); "
122122

123-
return query
123+
return query, []interface{}{pg.In(ciPipelineIDs)}
124124
}
125125

126126
func getAppListingCommonQueryString() string {

‎pkg/auth/user/repository/DefaultAuthPolicyRepository.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -70,15 +70,18 @@ func (impl DefaultAuthPolicyRepositoryImpl) UpdatePolicyByRoleType(policy string
7070

7171
func (impl DefaultAuthPolicyRepositoryImpl) GetPolicyByRoleTypeAndEntity(roleType bean.RoleType, accessType string, entity string) (policy string, err error) {
7272
var model DefaultAuthPolicy
73-
query := "SELECT * FROM default_auth_policy WHERE role_type = ? "
74-
query += " and entity = '" + entity + "' "
73+
var queryParams []interface{}
74+
query := "SELECT * FROM default_auth_policy WHERE role_type = ? AND entity = ? "
75+
queryParams = append(queryParams, roleType, entity)
76+
7577
if accessType == "" {
76-
query += "and access_type IS NULL ;"
78+
query += "AND access_type IS NULL ;"
7779
} else {
78-
query += "and access_type ='" + accessType + "' ;"
80+
query += "AND access_type = ? ;"
81+
queryParams = append(queryParams, accessType)
7982
}
8083

81-
_, err = impl.dbConnection.Query(&model, query, roleType)
84+
_, err = impl.dbConnection.Query(&model, query, queryParams...)
8285
if err != nil {
8386
impl.logger.Error("error in getting policy by roleType", "err", err, "roleType", roleType, "entity", entity)
8487
return "", err

‎pkg/auth/user/repository/helper/UserRepositoryQueryBuilder.go‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package helper
1818

1919
import (
2020
"fmt"
21+
2122
bean2 "github.com/devtron-labs/devtron/pkg/auth/user/bean"
2223
"github.com/devtron-labs/devtron/util"
2324
)
@@ -83,11 +84,27 @@ func GetQueryForGroupListingWithFilters(req *bean2.ListingRequest) (string, []in
8384

8485
orderCondition := ""
8586
if len(req.SortBy) > 0 && !req.CountCheck {
86-
orderCondition += " order by "
87+
// Validate SortBy to prevent SQL injection - only allow safe column names
88+
var sortColumn string
89+
switch req.SortBy {
90+
case bean2.GroupName:
91+
sortColumn = "name"
92+
case "id":
93+
sortColumn = "id"
94+
case "created_on":
95+
sortColumn = "created_on"
96+
case "updated_on":
97+
sortColumn = "updated_on"
98+
default:
99+
// Default to name if invalid sort field provided
100+
sortColumn = "name"
101+
}
102+
103+
orderCondition += " order by " + sortColumn
87104
if req.SortOrder == bean2.Desc {
88-
orderCondition += fmt.Sprintf(" %s %s ", req.SortBy, bean2.Desc)
105+
orderCondition += " DESC"
89106
} else {
90-
orderCondition += fmt.Sprintf(" %s ", req.SortBy)
107+
orderCondition += " ASC"
91108
}
92109
}
93110
if req.Size > 0 && !req.CountCheck && !req.ShowAll {

0 commit comments

Comments
 (0)