Merge pull request 'Read a plan by its id as a parameter, never as SQL (issue 561)' (#268) from fix/561-plan-id-parameter into main

cmd/mesh-controller/plan_ids.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"fmt"
+	"regexp"
+)
+
+// planID is every id the mesh gives a plan: a merge's walk or batch (plan-<nanoseconds>) or a release
+// (release-<nanoseconds>).
+var planID = regexp.MustCompile(`^(plan|release)-[0-9]+$`)
+
+// planIDArguments are the arguments of plans that name a plan. wait is among them for when it is declared
+// (novox/hq issue 229); an argument not declared is refused before this is asked.
+var planIDArguments = []string{"id", "wait", "stop", "close", "retry", "go"}
+
+// plainPlanIDs refuses a plans call naming a plan by anything but a plan's id (novox/hq issue 561): checked
+// once, where the call becomes a command line, so nothing else a caller sent reaches a command or the store.
+func plainPlanIDs(given map[string]string) error {
+	for _, arg := range planIDArguments {
+		if id, named := given[arg]; named && !planID.MatchString(id) {
+			return fmt.Errorf("plans %s: %q is not a plan's id (plan-<digits> or release-<digits>, as `plans` "+
+				"lists them); nothing was done", arg, id)
+		}
+	}
+	return nil
+}

cmd/mesh-controller/plan_ids_test.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+// **A plan's id is checked once, where a call becomes a command line** (novox/hq issue 561): every argument of
+// plans that names a plan is refused unless it is an id the mesh gives a plan, so a quote never reaches a
+// command, nor the store behind it.
+func TestAPlanIdThatIsNoPlansIdIsRefusedBeforeACommandStarts(t *testing.T) {
+	for _, arg := range []string{"id", "stop", "close", "retry", "go"} {
+		for _, bad := range []string{"x' or '1'='1", "plan-1'", "plan-", "plan-1 2", "batch-1", "PLAN-1"} {
+			args := map[string]any{arg: bad}
+			if arg == "stop" || arg == "close" || arg == "go" {
+				args["why"] = "a test"
+			}
+			argv, err := argvFor("plans", args)
+			if err == nil {
+				t.Errorf("plans %s %q was composed: %v", arg, bad, argv)
+				continue
+			}
+			if !strings.Contains(err.Error(), "is not a plan's id") {
+				t.Errorf("plans %s %q was refused for another reason: %v", arg, bad, err)
+			}
+		}
+		for _, good := range []string{"plan-1791813626034291775", "release-1791811938267404408"} {
+			args := map[string]any{arg: good}
+			if arg == "stop" || arg == "close" || arg == "go" {
+				args["why"] = "a test"
+			}
+			if _, err := argvFor("plans", args); err != nil {
+				t.Errorf("plans %s %q was refused: %v", arg, good, err)
+			}
+		}
+	}
+}

cmd/mesh-controller/seatverbs.go

@@ -336,6 +336,9 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		}
 		return argv, nil
 	case "plans":
+		if err := plainPlanIDs(a.given); err != nil {
+			return nil, err
+		}
 		if r := str("repository"); r != "" {
 			argv := []string{"plans", "--what-if", r}
 			if p := str("paths"); p != "" {

internal/inventory/plan_id_test.go

@@ -0,0 +1,45 @@
+package inventory
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// **A plan's id is a value, never SQL** (novox/hq issue 561): the id reaches PlanByID from a caller of the
+// controller's plans verb, so an id holding a quote is read as a plain id — no error from the store, and no
+// other plan answered for it.
+func TestAPlanIdHoldingAQuoteIsReadAsAPlainId(t *testing.T) {
+	inv := ForTest(t)
+	ctx := t.Context()
+	p := Plan{ID: "plan-561", Repository: "novox/mesh-controller", Commit: "abc", Created: time.Now().UTC(),
+		State: PlanBuilding, Tiers: [][]string{{"a"}}, Modules: map[string]*PlanModule{"a": {}}}
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range []string{
+		"x' or '1'='1",            // every plan, when pasted into the query
+		"plan-561' or id like '%", // the plan above, by a pattern
+		"it's",                    // a quote alone: a syntax error, when pasted
+	} {
+		got, err := inv.PlanByID(ctx, id)
+		if err == nil {
+			t.Fatalf("PlanByID(%q) answered %s, a plan of another id", id, got.ID)
+		}
+		if want := "no plan " + id; err.Error() != want {
+			t.Fatalf("PlanByID(%q) failed with %q, not as a plain id no plan has (%q)", id, err, want)
+		}
+	}
+	// A plan whose id holds a quote is found by it, and by nothing else.
+	quoted := p
+	quoted.ID, quoted.Revision = "plan-'561'", 0
+	if err := inv.SavePlan(ctx, &quoted); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := inv.PlanByID(ctx, quoted.ID); err != nil || got.ID != quoted.ID {
+		t.Fatalf("the plan with a quote in its id was not read back: %v %+v", err, got.ID)
+	}
+	if recent, err := inv.RecentPlans(ctx, 1); err != nil || len(recent) != 1 || !strings.HasPrefix(recent[0].ID, "plan-") {
+		t.Fatalf("RecentPlans with a parameter: %v %+v", err, recent)
+	}
+}

internal/inventory/plans.go

@@ -623,7 +623,7 @@ func (i *Inventory) PlansSince(ctx context.Context, since time.Time) ([]Plan, er
 
 // RecentPlans is the last few plans, newest first, open or not — what the overview shows.
 func (i *Inventory) RecentPlans(ctx context.Context, limit int) ([]Plan, error) {
-	return i.plans(ctx, fmt.Sprintf(`order by created desc limit %d`, limit))
+	return i.plans(ctx, `order by created desc limit $1`, limit)
 }
 
 // NewestMergeOf is the plan, in any state, of the newest merge into a repository's branch that the mesh
@@ -638,9 +638,10 @@ func (i *Inventory) NewestMergeOf(ctx context.Context, repository, branch string
 	return plans[0], true, nil
 }
 
-// PlanByID is one plan.
+// PlanByID is one plan. The id is a parameter, never part of the query (novox/hq issue 561): it comes from a
+// caller of the plans verb.
 func (i *Inventory) PlanByID(ctx context.Context, id string) (Plan, error) {
-	plans, err := i.plans(ctx, `where id = '`+id+`'`)
+	plans, err := i.plans(ctx, `where id = $1`, id)
 	if err != nil {
 		return Plan{}, err
 	}

testdata/store-tests

@@ -13,6 +13,7 @@
 ./internal/inventory TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain
 ./internal/inventory TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance
 ./internal/inventory TestAConditionsLooksAreKeptBesideTheBucket
+./internal/inventory TestAPlanIdHoldingAQuoteIsReadAsAPlainId
 ./cmd/mesh-controller TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds
 ./internal/inventory TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid
 ./cmd/mesh-controller TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded