From 1f2ec0fc1481c4833efc98e282be2a812e340f52 Mon Sep 17 00:00:00 2001 From: Jon Seager Date: Fri, 6 Feb 2026 17:52:08 +0000 Subject: [PATCH] fix(security): replace string interpolation with static match in gear SQL filter GearCategory is a Rust enum so this was not exploitable, but the format!() pattern is a code smell. Use a match returning &'static str literals instead for consistency with the rest of the parameterised query codebase. --- src/infrastructure/repositories/gear.rs | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/infrastructure/repositories/gear.rs b/src/infrastructure/repositories/gear.rs index bc93201..e2d0a78 100644 --- a/src/infrastructure/repositories/gear.rs +++ b/src/infrastructure/repositories/gear.rs @@ -51,11 +51,12 @@ impl SqlGearRepository { }) } - fn build_where_clause(filter: &GearFilter) -> Option { - filter - .category - .as_ref() - .map(|category| format!("category = '{}'", category.as_str())) + fn build_where_clause(filter: &GearFilter) -> Option<&'static str> { + filter.category.as_ref().map(|category| match category { + GearCategory::Grinder => "category = 'grinder'", + GearCategory::Brewer => "category = 'brewer'", + GearCategory::FilterPaper => "category = 'filter_paper'", + }) } }