Move db calls to prepared statements with context · SigNoz/signoz#1353

(11 comments) (0 reactions) (1 assignee)TypeScript (16,037 stars) (976 forks)batch import

backendgood first issue

説明

Move all db calls to prepared statements and specifically with context if possible to make signoz more secure from sql injections. A query should not be a string prepared from fmt.sprintf(...) if it has args to pass. We should try to avoid string formatting for args.

コントリビューターガイド

技術スタック: typescriptnodejssql
領域: backendsecurity
Issue 種別: security
難度: 4
推定時間: over 1 week
活動状況: blocked
明確さ: mostly clear
前提条件: TypeScriptNode.jsSQLprepared statements
初心者向け度: 35
調査方針: Examine the repository's database access layer to identify all locations where SQL queries are constructed using string formatting (e.g., fmt.Sprintf). Review the issue comments for specific patterns mentioned by maintainers. Focus on files in the 'pkg' or 'server' directories that handle database operations. Look for existing prepared statement usage to understand the preferred pattern. Consider starting with one module to demonstrate the approach before expanding to the entire codebase.