[#12048] SQL injection test for FeedbackQuestionsDbIT

[EuniceSim142]

Part of #12048. Test for SQL injections in FeedbackQuestions database methods.

---

Tests not created for the following db methods as they do not accept string params (so they're type-checked at compile time):

• getFeedbackQuestion
• getFeedbackQuestionsForSession
• getFeedbackQuestionsForGiverType (query uses feedbackSession's id which is UUID and giverType which is FeedbackParticipantType)
• deleteFeedbackQuestion

[jayasting98]

What about the other methods? Like getFeedbackQuestionsForSession, getFeedbackQuestionsForGiverType, etc.

[weiquu]

@EuniceSim142 shall we test for the getFeedbackQuestionsForGiverType method as well? Just pass in a FeedbackSession that has injection strings in name / email / etc. I think the other methods that use UUID don't need to be tested. Do also fix the lint checks

[EuniceSim142]

@EuniceSim142 shall we test for the getFeedbackQuestionsForGiverType method as well? Just pass in a FeedbackSession that has injection strings in name / email / etc. I think the other methods that use UUID don't need to be tested. Do also fix the lint checks

I don't think this works as having the sqli string in name and email of feedback session won't inject it into the sql query:

cq.select(root)
                .where(cb.and(
                        cb.equal(fqJoin.get("id"), feedbackSession.getId()),
                        cb.equal(root.get("giverType"), giverType)));

the query only uses giver type and id which are typed, and name and email which contain the sqli are not used in the where clause.

[jayasting98]

Yea, in that case, I think it's fine then.

[weiquu]

LGTM

[jayasting98]

@EuniceSim142 Let's get the checks to pass and resolve the merge conflict before we merge.