SigNoz/signoz

Move db calls to prepared statements with context

Open

#1,353 opened on Jul 4, 2022

View on GitHub
 (11 comments) (0 reactions) (1 assignee)TypeScript (976 forks)batch import
backendgood first issue

Repository metrics

Stars
 (16,037 stars)
PR merge metrics
 (Avg merge 5d 13h) (222 merged PRs in 30d)

Description

Move all db calls to prepared statements and specifically with context if possible to make signoz more secure from sql injections. A query should not be a string prepared from fmt.sprintf(...) if it has args to pass. We should try to avoid string formatting for args.

Contributor guide

Research direction
Identify all database queries in the codebase that use string formatting for parameters and refactor them to use prepared statements with context.
Tech stack
typescript
Domain
backend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitTypeScript
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70