Fix: SQL Injection in Database Migration

[grich88]

🔧 Fix Implementation

This PR addresses the critical SQL injection vulnerability identified in issue #346.

Changes Made

• Replace string interpolation with parameterized queries
• Add input validation and sanitization
• Implement proper error handling
• Add SQL injection prevention measures

Security Improvements

1. Eliminates SQL injection vulnerability
2. Implements parameterized queries
3. Adds input validation and sanitization
4. Implements proper error handling
5. Adds SQL injection prevention measures

Files Modified

• workflow/packages/backend/api/src/app/database/migration/postgres/1676505294811-encrypt-credentials.ts

Code Changes

Before (Vulnerable)

ypescript // VULNERABLE CODE await queryRunner.query( UPDATE app_connection SET value = '' WHERE id = );

After (Fixed)

ypescript // FIXED CODE - Use parameterized queries await queryRunner.query( 'UPDATE app_connection SET value = WHERE id = ', [JSON.stringify(currentConnection.value), currentConnection.id] );

Impact

• Eliminates SQL injection vulnerability
• Prevents database compromise
• Implements parameterized queries
• Adds input validation and sanitization
• Follows security best practices for database operations

Researcher: grich88 (j.grant.richards@proton.me)

Closes #346