From 7e912573da7eda335f80141c59b1c4d10039019d Mon Sep 17 00:00:00 2001
From: Uday Rana <82779467+uday-rana@users.noreply.github.com>
Date: Mon, 20 Jan 2025 23:20:04 -0500
Subject: [PATCH] [GH-29548] Avoid SELECT * in `tokens_store.go` (#29558)

* migrate Token Store GetByToken query to SQLBuilder

* explicitly enumerate columns, factor out query into constructor

* fix syntax error

* fix error handling

* spread args... instead of passing the array as a single param

* fix MySQL by casing columns correctly

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Jesse Hallam <jesse.hallam@gmail.com>
---
 .../channels/store/sqlstore/tokens_store.go   | 26 ++++++++++++++-----
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/server/channels/store/sqlstore/tokens_store.go b/server/channels/store/sqlstore/tokens_store.go
index 141642d94e..9158e528f7 100644
--- a/server/channels/store/sqlstore/tokens_store.go
+++ b/server/channels/store/sqlstore/tokens_store.go
@@ -17,10 +17,20 @@ import (
 
 type SqlTokenStore struct {
 	*SqlStore
+
+	tokenSelectQuery sq.SelectBuilder
 }
 
 func newSqlTokenStore(sqlStore *SqlStore) store.TokenStore {
-	return &SqlTokenStore{sqlStore}
+	s := SqlTokenStore{
+		SqlStore: sqlStore,
+	}
+
+	s.tokenSelectQuery = s.getQueryBuilder().
+		Select("Token", "CreateAt", "Type", "Extra").
+		From("Tokens")
+
+	return &s
 }
 
 func (s SqlTokenStore) Save(token *model.Token) error {
@@ -51,11 +61,17 @@ func (s SqlTokenStore) Delete(token string) error {
 func (s SqlTokenStore) GetByToken(tokenString string) (*model.Token, error) {
 	var token model.Token
 
-	if err := s.GetReplica().Get(&token, "SELECT * FROM Tokens WHERE Token = ?", tokenString); err != nil {
+	query, args, err := s.tokenSelectQuery.
+		Where(sq.Eq{"Token": tokenString}).
+		ToSql()
+	if err != nil {
+		return nil, errors.Wrap(err, "could not build sql query to get token store")
+	}
+
+	if err := s.GetReplica().Get(&token, query, args...); err != nil {
 		if err == sql.ErrNoRows {
 			return nil, store.NewErrNotFound("Token", fmt.Sprintf("Token=%s", tokenString))
 		}
-
 		return nil, errors.Wrapf(err, "failed to get Token with value %s", tokenString)
 	}
 
@@ -70,9 +86,7 @@ func (s SqlTokenStore) Cleanup(expiryTime int64) {
 
 func (s SqlTokenStore) GetAllTokensByType(tokenType string) ([]*model.Token, error) {
 	tokens := []*model.Token{}
-	query, args, err := s.getQueryBuilder().
-		Select("*").
-		From("Tokens").
+	query, args, err := s.tokenSelectQuery.
 		Where(sq.Eq{"Type": tokenType}).
 		ToSql()
 	if err != nil {