fixup! RHINENG-12951: fix for CWE-89

RedHatInsights · Oct 4, 2024 · b6eed3b · b6eed3b
1 parent 78654c4
commit b6eed3b
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/manager/controllers/utils.go b/manager/controllers/utils.go
@@ -81,8 +81,15 @@ func ApplySort(c *gin.Context, tx *gorm.DB, fieldExprs database.AttrMap,
 			return nil, nil, errors.Errorf("Invalid sort field: %v", enteredField)
 		}
 		// column := fmt.Sprintf("%s %s NULLS LAST", fieldExprs[enteredField].OrderQuery, ascDesc)
-		column := clause.OrderBy{Expression: clause.Expr{
-			SQL: "? ? NULLS LAST", Vars: []any{fieldExprs[enteredField].OrderQuery, ascDesc}}}
+		//  column := clause.OrderByColumn{Column: clause.Column{Name: fieldExprs[enteredField].OrderQuery},
+		//     Desc: false, Reorder: false}
+		//  column.Column.Name = fmt.Sprintf("%s %s NULLS LAST", column.Column.Name, ascDesc)
+		column := clause.OrderByColumn{
+			Column: clause.Column{Name: fmt.Sprintf("%s %s NULLS LAST", fieldExprs[enteredField].OrderQuery, ascDesc),
+				Raw: true},
+			Desc:    false,
+			Reorder: false,
+		}
 
 		tx = tx.Order(column)
 		appliedFields = append(appliedFields, origEnteredField)