feat(sql): SQL Injection

build/delete.go

@@ -7,10 +7,58 @@ import (
 	"git.secnex.io/secnex/pgson/utils"
 )
 
-func DeleteSQL(s *schema.Table, where string) (string, error) {
-	return fmt.Sprintf("UPDATE %s SET deleted_at = CURRENT_TIMESTAMP WHERE %s = %s", utils.SQLQuoteIdent(s.Name), utils.SQLQuoteIdent(s.PrimaryKey), utils.SQLQuoteValue(where)), nil
+func DeleteSQL(s *schema.Table, where any) (string, error) {
+	if s == nil {
+		return "", fmt.Errorf("nil table provided")
+	}
+	if s.Name == "" || !utils.IsValidIdentifier(s.Name) {
+		return "", fmt.Errorf("invalid table name: %q", s.Name)
+	}
+	if s.PrimaryKey == "" || !utils.IsValidIdentifier(s.PrimaryKey) {
+		return "", fmt.Errorf("invalid primary key: %q", s.PrimaryKey)
+	}
+	found := false
+	for i := range s.Schema {
+		if s.Schema[i].Name == s.PrimaryKey {
+			found = true
+			break
+		}
+	}
+	if !found {
+		return "", fmt.Errorf("primary key %q not found in schema", s.PrimaryKey)
+	}
+
+	return fmt.Sprintf("UPDATE %s SET deleted_at = CURRENT_TIMESTAMP WHERE %s = %s",
+		utils.SQLQuoteIdent(s.Name),
+		utils.SQLQuoteIdent(s.PrimaryKey),
+		utils.SQLQuoteValue(where),
+	), nil
 }
 
-func HardDeleteSQL(s *schema.Table, where string) (string, error) {
-	return fmt.Sprintf("DELETE FROM %s WHERE %s = %s", utils.SQLQuoteIdent(s.Name), utils.SQLQuoteIdent(s.PrimaryKey), utils.SQLQuoteValue(where)), nil
+func HardDeleteSQL(s *schema.Table, where any) (string, error) {
+	if s == nil {
+		return "", fmt.Errorf("nil table provided")
+	}
+	if s.Name == "" || !utils.IsValidIdentifier(s.Name) {
+		return "", fmt.Errorf("invalid table name: %q", s.Name)
+	}
+	if s.PrimaryKey == "" || !utils.IsValidIdentifier(s.PrimaryKey) {
+		return "", fmt.Errorf("invalid primary key: %q", s.PrimaryKey)
+	}
+	found := false
+	for i := range s.Schema {
+		if s.Schema[i].Name == s.PrimaryKey {
+			found = true
+			break
+		}
+	}
+	if !found {
+		return "", fmt.Errorf("primary key %q not found in schema", s.PrimaryKey)
+	}
+
+	return fmt.Sprintf("DELETE FROM %s WHERE %s = %s",
+		utils.SQLQuoteIdent(s.Name),
+		utils.SQLQuoteIdent(s.PrimaryKey),
+		utils.SQLQuoteValue(where),
+	), nil
 }