Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add helper code on ResourceManager-based repositories to handle list pagination and avoid query injection #2388

Closed
danielbdias opened this issue Apr 14, 2023 · 2 comments · Fixed by #2839
Assignees
Labels

Comments

@danielbdias
Copy link
Contributor

On our repo list methods, we have the same pagination code made, like here:

listQuery := baseSelect

if sortDirection == "" {
	sortDirection = "ASC"
}

if query != "" {
	listQuery = fmt.Sprintf("%s WHERE %s", listQuery, query)
}

if sortBy != "" {
	listQuery = fmt.Sprintf("%s ORDER BY %s %s", listQuery, sortBy, sortDirection)
}

if take > 0 {
	listQuery = fmt.Sprintf("%s LIMIT %d", listQuery, take)
}

if skip > 0 {
	listQuery = fmt.Sprintf("%s OFFSET %d", listQuery, skip)
}

We should:

  1. Move this code to an auxiliary method and allow other resources to use them.
  2. Standardize how we work with the query parameter and insert them safely on the query string.
@kdhamric
Copy link
Collaborator

kdhamric commented Jun 7, 2023

@danielbdias Do we still need this issue? Please close if not. If we do need it, if we are not going to work on it in the next couple weeks lets take it off the project board unless there is a good reason for it to be here.

@danielbdias
Copy link
Contributor Author

@schoren already created some helpers to that here: https://github.com/kubeshop/tracetest/tree/main/server/pkg/sqlutil

We can change our first resources to use it, but probably later. I'll take it from the board for now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
2 participants