avoid SELECT * in command stores (#30831)

* avoid SELECT * in command stores

* Define column names once and reuse as columns list in selects and inserts

* Define column names once and reuse with ExecBuilder

server/channels/store/sqlstore/command_store.go

@@ -17,14 +17,36 @@ import (
 type SqlCommandStore struct {
 	*SqlStore
 
-	commandsQuery sq.SelectBuilder
+	commandColumns []string
+	commandsQuery  sq.SelectBuilder
 }
 
 func newSqlCommandStore(sqlStore *SqlStore) store.CommandStore {
 	s := &SqlCommandStore{SqlStore: sqlStore}
 
+	s.commandColumns = []string{
+		"Id",
+		"Token",
+		"CreateAt",
+		"UpdateAt",
+		"DeleteAt",
+		"CreatorId",
+		"TeamId",
+		s.toReserveCase("trigger"),
+		"Method",
+		"Username",
+		"IconURL",
+		"AutoComplete",
+		"AutoCompleteDesc",
+		"AutoCompleteHint",
+		"DisplayName",
+		"Description",
+		"URL",
+		"PluginId",
+	}
+
 	s.commandsQuery = s.getQueryBuilder().
-		Select("*").
+		Select(s.commandColumns...).
 		From("Commands")
 	return s
 }
@@ -39,16 +61,31 @@ func (s SqlCommandStore) Save(command *model.Command) (*model.Command, error) {
 		return nil, err
 	}
 
-	// Trigger is a keyword
+	insertQuery := s.getQueryBuilder().
-	trigger := s.toReserveCase("trigger")
+		Insert("Commands").
+		Columns(s.commandColumns...).
+		Values(
+			command.Id,
+			command.Token,
+			command.CreateAt,
+			command.UpdateAt,
+			command.DeleteAt,
+			command.CreatorId,
+			command.TeamId,
+			command.Trigger,
+			command.Method,
+			command.Username,
+			command.IconURL,
+			command.AutoComplete,
+			command.AutoCompleteDesc,
+			command.AutoCompleteHint,
+			command.DisplayName,
+			command.Description,
+			command.URL,
+			command.PluginId,
+		)
 
-	if _, err := s.GetMaster().NamedExec(`INSERT INTO Commands (Id, Token, CreateAt,
+	if _, err := s.GetMaster().ExecBuilder(insertQuery); err != nil {
-		UpdateAt, DeleteAt, CreatorId, TeamId, `+trigger+`, Method, Username,
-		IconURL, AutoComplete, AutoCompleteDesc, AutoCompleteHint, DisplayName, Description,
-		URL, PluginId)
-	VALUES (:Id, :Token, :CreateAt, :UpdateAt, :DeleteAt, :CreatorId, :TeamId, :Trigger, :Method,
-		:Username, :IconURL, :AutoComplete, :AutoCompleteDesc, :AutoCompleteHint, :DisplayName,
-		:Description, :URL, :PluginId)`, command); err != nil {
 		return nil, errors.Wrapf(err, "insert: command_id=%s", command.Id)
 	}
 

server/channels/store/sqlstore/command_webhook_store.go

@@ -16,10 +16,31 @@ import (
 
 type SqlCommandWebhookStore struct {
 	*SqlStore
+
+	commandWebhookColumns []string
+	commandWebhookQuery   sq.SelectBuilder
 }
 
 func newSqlCommandWebhookStore(sqlStore *SqlStore) store.CommandWebhookStore {
-	return &SqlCommandWebhookStore{sqlStore}
+	s := &SqlCommandWebhookStore{
+		SqlStore: sqlStore,
+	}
+
+	s.commandWebhookColumns = []string{
+		"Id",
+		"CreateAt",
+		"CommandId",
+		"UserId",
+		"ChannelId",
+		"RootId",
+		"UseCount",
+	}
+
+	s.commandWebhookQuery = s.getQueryBuilder().
+		Select(s.commandWebhookColumns...).
+		From("CommandWebhooks")
+
+	return s
 }
 
 func (s SqlCommandWebhookStore) Save(webhook *model.CommandWebhook) (*model.CommandWebhook, error) {
@@ -32,10 +53,20 @@ func (s SqlCommandWebhookStore) Save(webhook *model.CommandWebhook) (*model.Comm
 		return nil, err
 	}
 
-	if _, err := s.GetMaster().NamedExec(`INSERT INTO CommandWebhooks
+	insertQuery := s.getQueryBuilder().
-		(Id,CreateAt,CommandId,UserId,ChannelId,RootId,UseCount)
+		Insert("CommandWebhooks").
-		Values
+		Columns(s.commandWebhookColumns...).
-		(:Id, :CreateAt, :CommandId, :UserId, :ChannelId, :RootId, :UseCount)`, webhook); err != nil {
+		Values(
+			webhook.Id,
+			webhook.CreateAt,
+			webhook.CommandId,
+			webhook.UserId,
+			webhook.ChannelId,
+			webhook.RootId,
+			webhook.UseCount,
+		)
+
+	if _, err := s.GetMaster().ExecBuilder(insertQuery); err != nil {
 		return nil, errors.Wrapf(err, "save: id=%s", webhook.Id)
 	}
 
@@ -47,9 +78,7 @@ func (s SqlCommandWebhookStore) Get(id string) (*model.CommandWebhook, error) {
 
 	exptime := model.GetMillis() - model.CommandWebhookLifetime
 
-	query := s.getQueryBuilder().
+	query := s.commandWebhookQuery.
-		Select("*").
-		From("CommandWebhooks").
 		Where(sq.Eq{"Id": id}).
 		Where(sq.Gt{"CreateAt": exptime})