The telemetry log query escapes SQL by hand
Table of Contents
This page is a capture in the inbox bucket of the product backlog — a pre-sprint idea, not yet pulled into a sprint as a story.
1. What
Move `build_where_clause()` in `projects/ores.telemetry/database/src/repository/telemetry_repository.cpp` from `std::format` string building with a hand-written `escape_sql_string()` to parameterized bind values.
2. Why
The reviewer on PR #2178 found it: the log query's `WHERE` clause is assembled as text, and two of its filters — `component` and `message_contains` — interpolate caller-supplied substrings into `LIKE` and `ILIKE` patterns. A hand-written escaper is the kind of code that is right until it is not, and every other repository in the tree binds its values.
The logic is pre-existing; the clean-up touched the file only to rename the payload types onto the generated ones, so it was recorded rather than fixed inside a component clean-up. The reviewer's point stands that the story already had the file open, and that the two filters deserve binding before anything else reaches them.
3. References
- `projects/ores.telemetry/database/src/repository/telemetry_repository.cpp` — `build_where_clause()` and `escape_sql_string()`.
- PR #2178 review — the observation that raised it.