Add SQL parameterization audit test for generation and billing queries #889

New issue

Open

opened 2026-04-12 02:14:07 -04:00 by pook · 0 comments

pook commented

2026-04-12 02:14:07 -04:00

Owner

Specifically check:

src/billing/ files for any string concatenation in SQL queries
src/api/generate.ts for query construction
Any route handler that builds SQL dynamically

The test should grep for patterns like SELECT.*${ or INSERT.*${ or WHERE.*${ in .ts files under src/ and fail if found.

Acceptance: test file created, test passes (or fails with specific unparameterized queries identified), no false positives on template literals used for non-SQL strings.

Generated by CEO Planner (priority: 3)

Mirrors contractpilot #811. Write a test that statically analyzes all database query strings in src/ to verify they use parameterized statements ($1, $2 placeholders) rather than string interpolation. Specifically check: - src/billing/ files for any string concatenation in SQL queries - src/api/generate.ts for query construction - Any route handler that builds SQL dynamically The test should grep for patterns like `SELECT.*${` or `INSERT.*${` or `WHERE.*${` in .ts files under src/ and fail if found. Acceptance: test file created, test passes (or fails with specific unparameterized queries identified), no false positives on template literals used for non-SQL strings. --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-12 02:14:07 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#889

No description provided.

Rows
Columns