From fdf897cc95c9054cbc13dd5cdbfe87313034ed4e Mon Sep 17 00:00:00 2001 From: Jonathan Leroy Date: Mon, 18 May 2026 03:05:47 +0200 Subject: [PATCH] Migration (v2.2.2): Use parameterized queries to prevent SQL injection patterns --- internal/migrations/v2.2.2.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/internal/migrations/v2.2.2.go b/internal/migrations/v2.2.2.go index b2fdc223..0c911f4e 100644 --- a/internal/migrations/v2.2.2.go +++ b/internal/migrations/v2.2.2.go @@ -22,10 +22,10 @@ func V2_2_2(db *sqlx.DB, fs stuffbin.FileSystem, ko *koanf.Koanf) error { } for localeCode, localeRegion := range langMap { - _, err := db.Exec(fmt.Sprintf(` - UPDATE settings SET value = '"%s"'::jsonb, updated_at = now() - WHERE key = 'app.lang' AND value = '"%s"'::jsonb; - `, localeRegion, localeCode)) + _, err := db.Exec(` + UPDATE settings SET value = to_jsonb($1::text), updated_at = now() + WHERE key = 'app.lang' AND value = to_jsonb($2::text); + `, localeRegion, localeCode) if err != nil { return err }