misc: Sql query fixes (#6097)

* sql injection fix

* more query fixes and error handling

* handle deleted / non-existent environment

---------

Co-authored-by: Prakash Kumar <prakash.kumar@devtron.ai>

Author: ayu-devtron

internal/sql/repository/AppListingRepository.go

@@ -124,7 +124,11 @@ func (impl AppListingRepositoryImpl) FetchJobs(appIds []int, statuses []string,
 		impl.Logger.Error(appsErr)
 		return jobContainers, appsErr
 	}
-	jobContainers = impl.extractEnvironmentNameFromId(jobContainers)
+	jobContainers, err := impl.extractEnvironmentNameFromId(jobContainers)
+	if err != nil {
+		impl.Logger.Errorw("Error in extractEnvironmentNameFromId", "jobContainers", jobContainers, "err", err)
+		return nil, err
+	}
 	return jobContainers, nil
 }
 
@@ -137,7 +141,11 @@ func (impl AppListingRepositoryImpl) FetchOverviewCiPipelines(jobId int) ([]*bea
 		impl.Logger.Error(appsErr)
 		return jobContainers, appsErr
 	}
-	jobContainers = impl.extractEnvironmentNameFromId(jobContainers)
+	jobContainers, err := impl.extractEnvironmentNameFromId(jobContainers)
+	if err != nil {
+		impl.Logger.Errorw("Error in extractEnvironmentNameFromId", "jobContainers", jobContainers, "err", err)
+		return nil, err
+	}
 	return jobContainers, nil
 }
 
@@ -732,7 +740,7 @@ func (impl AppListingRepositoryImpl) FindAppCount(isProd bool) (int, error) {
 	return count, nil
 }
 
-func (impl AppListingRepositoryImpl) extractEnvironmentNameFromId(jobContainers []*bean.JobListingContainer) []*bean.JobListingContainer {
+func (impl AppListingRepositoryImpl) extractEnvironmentNameFromId(jobContainers []*bean.JobListingContainer) ([]*bean.JobListingContainer, error) {
 	var envIds []*int
 	for _, job := range jobContainers {
 		if job.EnvironmentId != 0 {
@@ -742,7 +750,11 @@ func (impl AppListingRepositoryImpl) extractEnvironmentNameFromId(jobContainers
 			envIds = append(envIds, &job.LastTriggeredEnvironmentId)
 		}
 	}
-	envs, _ := impl.environmentRepository.FindByIds(envIds)
+	envs, err := impl.environmentRepository.FindByIds(envIds)
+	if err != nil {
+		impl.Logger.Errorw("Error in getting environment", "envIds", envIds, "err", err)
+		return nil, err
+	}
 
 	envIdNameMap := make(map[int]string)
 
@@ -759,5 +771,5 @@ func (impl AppListingRepositoryImpl) extractEnvironmentNameFromId(jobContainers
 		}
 	}
 
-	return jobContainers
+	return jobContainers, nil
 }

pkg/appStore/installedApp/repository/InstalledAppVersionHistory.go

@@ -216,7 +216,6 @@ func (impl *InstalledAppVersionHistoryRepositoryImpl) UpdateDeploymentHistoryMes
 	_, err := impl.dbConnection.Model((*InstalledAppVersionHistory)(nil)).
 		Set("message = ?", message).
 		Where("id = ?", installedAppVersionHistoryId).
-		Where("active = ?", true).
 		Update()
 	return err
 }

pkg/cluster/EnvironmentService.go

@@ -472,6 +472,7 @@ func (impl EnvironmentServiceImpl) FindByIds(ids []*int) ([]*bean2.EnvironmentBe
 	models, err := impl.environmentRepository.FindByIds(ids)
 	if err != nil {
 		impl.logger.Errorw("error in fetching environment", "err", err)
+		return nil, err
 	}
 	var beans []*bean2.EnvironmentBean
 	for _, model := range models {

pkg/cluster/repository/EnvironmentRepository.go

@@ -325,6 +325,9 @@ func (repositoryImpl EnvironmentRepositoryImpl) FindByClusterId(clusterId int) (
 
 func (repositoryImpl EnvironmentRepositoryImpl) FindByIds(ids []*int) ([]*Environment, error) {
 	var apps []*Environment
+	if len(ids) == 0 {
+		return []*Environment{}, nil
+	}
 	err := repositoryImpl.dbConnection.Model(&apps).Where("active = ?", true).Where("id in (?)", pg.In(ids)).Select()
 	return apps, err
 }

pkg/externalLink/ExternalLinkIdentifierMappingRepository.go

@@ -108,7 +108,7 @@ func (impl ExternalLinkIdentifierMappingRepositoryImpl) FindAllActiveByLinkIdent
 				 elim.id as mapping_id,elim.active,elim.type,elim.identifier,elim.env_id,elim.app_id,elim.cluster_id 
 				 FROM external_link el 
 				 LEFT JOIN external_link_identifier_mapping elim ON el.id = elim.external_link_id 
-				 WHERE el.active = true and elim.active = true and ( (elim.type = %d and elim.identifier = '%s' and elim.cluster_id = 0) or (elim.type = 0 and elim.app_id = 0 and elim.cluster_id = %d)  
+				 WHERE el.active = true and elim.active = true and ( (elim.type = ? and elim.identifier = ? and elim.cluster_id = 0) or (elim.type = 0 and elim.app_id = 0 and elim.cluster_id = ?)  
 				 or (elim.type = -1) );`
 		queryParams = append(queryParams, TypeMappings[linkIdentifier.Type], linkIdentifier.Identifier, clusterId)
 	}

pkg/pipeline/DeploymentPipelineConfigService.go

@@ -237,6 +237,10 @@ func (impl *CdPipelineConfigServiceImpl) GetCdPipelineById(pipelineId int) (cdPi
 		impl.logger.Errorw("error in fetching pipeline", "err", err)
 		return cdPipeline, err
 	}
+	if environment == nil || environment.Id == 0 {
+		impl.logger.Errorw("environment doesn't exists", "environmentId", dbPipeline.EnvironmentId)
+		return cdPipeline, err
+	}
 	strategies, err := impl.pipelineConfigRepository.GetAllStrategyByPipelineId(dbPipeline.Id)
 	if err != nil && errors.IsNotFound(err) {
 		impl.logger.Errorw("error in fetching strategies", "err", err)

pkg/security/policyService.go

@@ -621,6 +621,10 @@ func (impl *PolicyServiceImpl) GetPolicies(policyLevel securityBean.PolicyLevel,
 			envId = append(envId, &pipeline.EnvironmentId)
 		}
 		envs, err := impl.environmentService.FindByIds(envId)
+		if err != nil {
+			impl.logger.Errorw("Error in fetching env", "envId", envId, "err", err)
+			return nil, err
+		}
 		for _, env := range envs {
 			cvePolicy, severityPolicy, err := impl.getPolicies(policyLevel, env.ClusterId, env.Id, appId)
 			if err != nil {