fix: Code security fixes (sql injection, sensitive data logs)

api/restHandler/DockerRegRestHandler.go

@@ -307,10 +307,10 @@ func (impl DockerRegRestHandlerImpl) ValidateDockerRegistryConfig(w http.Respons
 	}
 	bean.User = userId
 
-	impl.logger.Infow("request payload, ValidateDockerRegistryConfig", "payload", bean)
+	impl.logger.Infow("request payload, ValidateDockerRegistryConfig", "dockerRegistryId", bean.Id)
 	err = impl.validator.Struct(bean)
 	if err != nil {
-		impl.logger.Errorw("validation err, ValidateDockerRegistryConfig", "err", err, "payload", bean)
+		impl.logger.Errorw("validation err, ValidateDockerRegistryConfig", "err", err, "dockerRegistryId", bean.Id)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
@@ -494,23 +494,23 @@ func (impl DockerRegRestHandlerImpl) UpdateDockerRegistryConfig(w http.ResponseW
 	var bean types.DockerArtifactStoreBean
 	err = decoder.Decode(&bean)
 	if err != nil {
-		impl.logger.Errorw("request err, UpdateDockerRegistryConfig", "err", err, "payload", bean)
+		impl.logger.Errorw("request err, UpdateDockerRegistryConfig", "err", err, "dockerRegistryId", bean.Id)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
 	bean.User = userId
 	requestErr := ValidateDockerArtifactStoreRequestBean(bean)
 	if requestErr != nil {
 		err = fmt.Errorf("invalid payload, missing or incorrect values for required fields")
-		impl.logger.Errorw("validation err, SaveDockerRegistryConfig", "err", err, "payload", bean)
+		impl.logger.Errorw("validation err, SaveDockerRegistryConfig", "err", err, "dockerRegistryId", bean.Id)
 		common.WriteJsonResp(w, requestErr, nil, http.StatusBadRequest)
 		return
 	}
 
-	impl.logger.Infow("request payload, UpdateDockerRegistryConfig", "err", err, "payload", bean)
+	impl.logger.Infow("request payload, UpdateDockerRegistryConfig", "err", err, "dockerRegistryId", bean.Id)
 	err = impl.validator.Struct(bean)
 	if err != nil {
-		impl.logger.Errorw("validation err, UpdateDockerRegistryConfig", "err", err, "payload", bean)
+		impl.logger.Errorw("validation err, UpdateDockerRegistryConfig", "err", err, "dockerRegistryId", bean.Id)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
@@ -525,7 +525,7 @@ func (impl DockerRegRestHandlerImpl) UpdateDockerRegistryConfig(w http.ResponseW
 
 	res, err := impl.dockerRegistryConfig.Update(&bean)
 	if err != nil {
-		impl.logger.Errorw("service err, UpdateDockerRegistryConfig", "err", err, "payload", bean)
+		impl.logger.Errorw("service err, UpdateDockerRegistryConfig", "err", err, "dockerRegistryId", bean.Id)
 		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
 		return
 	}

api/restHandler/GitProviderRestHandler.go

@@ -175,15 +175,15 @@ func (impl GitProviderRestHandlerImpl) UpdateGitRepoConfig(w http.ResponseWriter
 	var bean types.GitRegistry
 	err = decoder.Decode(&bean)
 	if err != nil {
-		impl.logger.Errorw("request err, UpdateGitRepoConfig", "err", err, "payload", bean)
+		impl.logger.Errorw("request err, UpdateGitRepoConfig", "err", err, "gitRegistryId", bean.Id)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
 	bean.UserId = userId
-	impl.logger.Infow("request payload, UpdateGitRepoConfig", "payload", bean)
+	impl.logger.Infow("request payload, UpdateGitRepoConfig", "gitRegistryId", bean.Id)
 	err = impl.validator.Struct(bean)
 	if err != nil {
-		impl.logger.Errorw("validation err, UpdateGitRepoConfig", "err", err, "payload", bean)
+		impl.logger.Errorw("validation err, UpdateGitRepoConfig", "err", err, "gitRegistryId", bean.Id)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
@@ -197,7 +197,7 @@ func (impl GitProviderRestHandlerImpl) UpdateGitRepoConfig(w http.ResponseWriter
 
 	res, err := impl.gitRegistryConfig.Update(&bean)
 	if err != nil {
-		impl.logger.Errorw("service err, UpdateGitRepoConfig", "err", err, "payload", bean)
+		impl.logger.Errorw("service err, UpdateGitRepoConfig", "err", err, "gitRegistryId", bean.Id)
 		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
 		return
 	}

api/restHandler/common/apiError.go

@@ -114,7 +114,7 @@ func WriteJsonResp(w http.ResponseWriter, err error, respBody interface{}, statu
 		}
 	}
 	if status > 299 || err != nil {
-		util.GetLogger().Infow("ERROR RES", "TYPE", "API-ERROR", "RES", response.Code, "ERROR-MSG", response.Errors, "err", err)
+		util.GetLogger().Infow("ERROR RES", "TYPE", "API-ERROR", "RES", response.Code, "err", err)
 	}
 	w.Header().Set(CONTENT_TYPE, APPLICATION_JSON)
 	w.WriteHeader(status)

client/gitSensor/GitSensorRestClient.go

@@ -273,7 +273,6 @@ func (session *RestClientImpl) doRequest(clientRequest *ClientRequest) (resBody
 		if req, err := json.Marshal(clientRequest.RequestBody); err != nil {
 			return nil, nil, err
 		} else {
-			session.logger.Debugw("argo req with body", "body", string(req))
 			body = bytes.NewBuffer(req)
 		}
 	}

internal/sql/repository/AppListingRepository.go

@@ -116,10 +116,10 @@ func (impl AppListingRepositoryImpl) FetchJobs(appIds []int, statuses []string,
 	if len(appIds) == 0 {
 		return jobContainers, nil
 	}
-	jobsQuery := impl.appListingRepositoryQueryBuilder.BuildJobListingQuery(appIds, statuses, environmentIds, sortOrder)
+	jobsQuery, jobsQueryParams := impl.appListingRepositoryQueryBuilder.BuildJobListingQuery(appIds, statuses, environmentIds, sortOrder)
 
 	impl.Logger.Debugw("basic app detail query: ", jobsQuery)
-	_, appsErr := impl.dbConnection.Query(&jobContainers, jobsQuery)
+	_, appsErr := impl.dbConnection.Query(&jobContainers, jobsQuery, jobsQueryParams...)
 	if appsErr != nil {
 		impl.Logger.Error(appsErr)
 		return jobContainers, appsErr
@@ -220,10 +220,10 @@ func (impl AppListingRepositoryImpl) FetchAppsByEnvironmentV2(appListingFilter h
 
 	if string(appListingFilter.SortBy) == helper.LastDeployedSortBy {
 
-		query := impl.appListingRepositoryQueryBuilder.GetAppIdsQueryWithPaginationForLastDeployedSearch(appListingFilter)
+		query, queryParams := impl.appListingRepositoryQueryBuilder.GetAppIdsQueryWithPaginationForLastDeployedSearch(appListingFilter)
 		impl.Logger.Debug("GetAppIdsQueryWithPaginationForLastDeployedSearch query ", query)
 		start := time.Now()
-		_, err := impl.dbConnection.Query(&lastDeployedTimeDTO, query)
+		_, err := impl.dbConnection.Query(&lastDeployedTimeDTO, query, queryParams...)
 		middleware.AppListingDuration.WithLabelValues("getAppIdsQueryWithPaginationForLastDeployedSearch", "devtron").Observe(time.Since(start).Seconds())
 		if err != nil || len(lastDeployedTimeDTO) == 0 {
 			if err != nil {
@@ -238,9 +238,9 @@ func (impl AppListingRepositoryImpl) FetchAppsByEnvironmentV2(appListingFilter h
 			appIdsFound[i] = obj.AppId
 		}
 		appListingFilter.AppIds = appIdsFound
-		appContainerQuery := impl.appListingRepositoryQueryBuilder.GetQueryForAppEnvContainerss(appListingFilter)
-		impl.Logger.Debug("GetQueryForAppEnvContainerss query ", query)
-		_, err = impl.dbConnection.Query(&appEnvContainer, appContainerQuery)
+		appContainerQuery, appContainerQueryParams := impl.appListingRepositoryQueryBuilder.GetQueryForAppEnvContainers(appListingFilter)
+		impl.Logger.Debug("GetQueryForAppEnvContainers query ", query)
+		_, err = impl.dbConnection.Query(&appEnvContainer, appContainerQuery, appContainerQueryParams...)
 		if err != nil {
 			impl.Logger.Errorw("error in getting appEnvContainers with appList filter from db", "err", err, "filter", appListingFilter, "query", appContainerQuery)
 			return appEnvArr, appsSize, err
@@ -250,10 +250,10 @@ func (impl AppListingRepositoryImpl) FetchAppsByEnvironmentV2(appListingFilter h
 
 		// to get all the appIds in appEnvs allowed for user and filtered by the appListing filter and sorted by name
 		appIdCountDtos := make([]*bean.AppEnvironmentContainer, 0)
-		appIdCountQuery := impl.appListingRepositoryQueryBuilder.GetAppIdsQueryWithPaginationForAppNameSearch(appListingFilter)
+		appIdCountQuery, appIdCountQueryParams := impl.appListingRepositoryQueryBuilder.GetAppIdsQueryWithPaginationForAppNameSearch(appListingFilter)
 		impl.Logger.Debug("GetAppIdsQueryWithPaginationForAppNameSearch query ", appIdCountQuery)
 		start := time.Now()
-		_, appsErr := impl.dbConnection.Query(&appIdCountDtos, appIdCountQuery)
+		_, appsErr := impl.dbConnection.Query(&appIdCountDtos, appIdCountQuery, appIdCountQueryParams...)
 		middleware.AppListingDuration.WithLabelValues("getAppIdsQueryWithPaginationForAppNameSearch", "devtron").Observe(time.Since(start).Seconds())
 		if appsErr != nil || len(appIdCountDtos) == 0 {
 			if appsErr != nil {
@@ -271,10 +271,10 @@ func (impl AppListingRepositoryImpl) FetchAppsByEnvironmentV2(appListingFilter h
 		appListingFilter.AppIds = uniqueAppIds
 		// set appids required for this page in the filter and get the appEnv containers of these apps
 		appListingFilter.AppIds = uniqueAppIds
-		appsEnvquery := impl.appListingRepositoryQueryBuilder.GetQueryForAppEnvContainerss(appListingFilter)
-		impl.Logger.Debug("GetQueryForAppEnvContainerss query: ", appsEnvquery)
+		appsEnvquery, appsEnvQueryParams := impl.appListingRepositoryQueryBuilder.GetQueryForAppEnvContainers(appListingFilter)
+		impl.Logger.Debug("GetQueryForAppEnvContainers query: ", appsEnvquery)
 		start = time.Now()
-		_, appsErr = impl.dbConnection.Query(&appEnvContainer, appsEnvquery)
+		_, appsErr = impl.dbConnection.Query(&appEnvContainer, appsEnvquery, appsEnvQueryParams...)
 		middleware.AppListingDuration.WithLabelValues("buildAppListingQuery", "devtron").Observe(time.Since(start).Seconds())
 		if appsErr != nil {
 			impl.Logger.Errorw("error in getting appEnvContainers with appList filter from db", "err", appsErr, "filter", appListingFilter, "query", appsEnvquery)

internal/sql/repository/app/AppRepository.go

@@ -21,6 +21,7 @@ import (
 	"github.com/devtron-labs/devtron/internal/sql/repository/helper"
 	"github.com/devtron-labs/devtron/pkg/sql"
 	"github.com/devtron-labs/devtron/pkg/team"
+	"github.com/devtron-labs/devtron/util"
 	"github.com/go-pg/pg"
 	"go.uber.org/zap"
 	"time"
@@ -290,9 +291,10 @@ func (repo AppRepositoryImpl) FindAllActiveAppsWithTeamWithTeamId(teamID int, ap
 
 func (repo AppRepositoryImpl) FindAllActiveAppsWithTeamByAppNameMatch(appNameMatch string, appType helper.AppType) ([]*App, error) {
 	var apps []*App
-	appNameLikeQuery := "app.app_name like '%" + appNameMatch + "%'"
 	err := repo.dbConnection.Model(&apps).Column("Team").
-		Where("app.active = ?", true).Where("app.app_type = ?", appType).Where(appNameLikeQuery).
+		Where("app.active = ?", true).
+		Where("app.app_type = ?", appType).
+		Where("app.app_name like ?", util.GetLIKEClauseQueryParam(appNameMatch)).
 		Select()
 	return apps, err
 }
@@ -499,24 +501,25 @@ func (repo AppRepositoryImpl) FetchAppIdsWithFilter(jobListingFilter helper.AppL
 		Id int `json:"id"`
 	}
 	var jobIds []AppId
-	whereCondition := " where active = true and app_type = 2 "
+	var queryParams []interface{}
+	query := "select id from app where active = true and app_type = 2  "
 	if len(jobListingFilter.Teams) > 0 {
-		whereCondition += " and team_id in (" + helper.GetCommaSepratedString(jobListingFilter.Teams) + ")"
+		query += " and team_id in (?) "
+		queryParams = append(queryParams, pg.In(jobListingFilter.Teams))
 	}
 	if len(jobListingFilter.AppIds) > 0 {
-		whereCondition += " and id in (" + helper.GetCommaSepratedString(jobListingFilter.AppIds) + ")"
+		query += " and id in (?) "
+		queryParams = append(queryParams, pg.In(jobListingFilter.AppIds))
 	}
-
 	if len(jobListingFilter.AppNameSearch) > 0 {
-		whereCondition += " and display_name like '%" + jobListingFilter.AppNameSearch + "%' "
+		query += " and display_name like ? "
+		queryParams = append(queryParams, util.GetLIKEClauseQueryParam(jobListingFilter.AppNameSearch))
 	}
-	orderByCondition := " order by display_name "
+	query += " order by display_name "
 	if jobListingFilter.SortOrder == "DESC" {
-		orderByCondition += string(jobListingFilter.SortOrder)
+		query += " DESC "
 	}
-	query := "select id " + "from app " + whereCondition + orderByCondition
-
-	_, err := repo.dbConnection.Query(&jobIds, query)
+	_, err := repo.dbConnection.Query(&jobIds, query, queryParams...)
 	appCounts := make([]int, 0)
 	for _, id := range jobIds {
 		appCounts = append(appCounts, id.Id)
@@ -535,12 +538,10 @@ func (repo AppRepositoryImpl) FetchAppIdsByDisplayNamesForJobs(names []string) (
 		DisplayName string `json:"display_name"`
 	}
 	var jobIdName []App
-	whereCondition := fmt.Sprintf(" where active = true and app_type = %v ", helper.Job)
-	whereCondition += " and display_name in (" + helper.GetCommaSepratedStringWithComma(names) + ");"
-	query := "select id, display_name from app " + whereCondition
-	_, err := repo.dbConnection.Query(&jobIdName, query)
-	appResp := make(map[int]string)
-	jobIds := make([]int, 0)
+	query := "select id, display_name from app where active = ? and app_type = ? and display_name in (?);"
+	_, err := repo.dbConnection.Query(&jobIdName, query, true, helper.Job, pg.In(names))
+	appResp := make(map[int]string, len(jobIdName))
+	jobIds := make([]int, 0, len(jobIdName))
 	for _, id := range jobIdName {
 		appResp[id.Id] = id.DisplayName
 		jobIds = append(jobIds, id.Id)