From cf392f7ccaa8377abb5e63bd10c9952f7588e734 Mon Sep 17 00:00:00 2001
From: Seiya Homma <99792735+Honsei901@users.noreply.github.com>
Date: Thu, 19 Dec 2024 21:57:10 +0900
Subject: [PATCH] [MM-62143] Avoid SELECT * in role_store.go

---
 server/channels/store/sqlstore/role_store.go | 31 ++++++++++++++------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/server/channels/store/sqlstore/role_store.go b/server/channels/store/sqlstore/role_store.go
index 84f8d6e1e0..aa8c02e84e 100644
--- a/server/channels/store/sqlstore/role_store.go
+++ b/server/channels/store/sqlstore/role_store.go
@@ -18,6 +18,8 @@ import (
 
 type SqlRoleStore struct {
 	*SqlStore
+
+	tableSelectQuery sq.SelectBuilder
 }
 
 type Role struct {
@@ -83,7 +85,15 @@ func (role Role) ToModel() *model.Role {
 }
 
 func newSqlRoleStore(sqlStore *SqlStore) store.RoleStore {
-	return &SqlRoleStore{sqlStore}
+	s := SqlRoleStore{
+		SqlStore: sqlStore,
+	}
+
+	s.tableSelectQuery = s.getQueryBuilder().
+		Select("Id", "Name", "DisplayName", "Description", "CreateAt", "UpdateAt", "DeleteAt", "Permissions", "SchemeManaged", "BuiltIn").
+		From("Roles")
+
+	return &s
 }
 
 func (s *SqlRoleStore) Save(role *model.Role) (_ *model.Role, err error) {
@@ -156,8 +166,9 @@ func (s *SqlRoleStore) createRole(role *model.Role, transaction *sqlxTxWrapper)
 
 func (s *SqlRoleStore) Get(roleId string) (*model.Role, error) {
 	dbRole := Role{}
+	query := s.tableSelectQuery.Where(sq.Eq{"Id": roleId})
 
-	if err := s.GetReplica().Get(&dbRole, "SELECT * from Roles WHERE Id = ?", roleId); err != nil {
+	if err := s.GetReplica().GetBuilder(&dbRole, query); err != nil {
 		if err == sql.ErrNoRows {
 			return nil, store.NewErrNotFound("Role", roleId)
 		}
@@ -169,8 +180,9 @@ func (s *SqlRoleStore) Get(roleId string) (*model.Role, error) {
 
 func (s *SqlRoleStore) GetAll() ([]*model.Role, error) {
 	dbRoles := []Role{}
+	query := s.tableSelectQuery
 
-	if err := s.GetReplica().Select(&dbRoles, "SELECT * from Roles"); err != nil {
+	if err := s.GetReplica().SelectBuilder(&dbRoles, query); err != nil {
 		return nil, errors.Wrap(err, "failed to find Roles")
 	}
 
@@ -183,7 +195,9 @@ func (s *SqlRoleStore) GetAll() ([]*model.Role, error) {
 
 func (s *SqlRoleStore) GetByName(ctx context.Context, name string) (*model.Role, error) {
 	dbRole := Role{}
-	if err := s.DBXFromContext(ctx).Get(&dbRole, "SELECT * from Roles WHERE Name = ?", name); err != nil {
+	query := s.tableSelectQuery.Where(sq.Eq{"Name": name})
+
+	if err := s.DBXFromContext(ctx).GetBuilder(&dbRole, query); err != nil {
 		if err == sql.ErrNoRows {
 			return nil, store.NewErrNotFound("Role", fmt.Sprintf("name=%s", name))
 		}
@@ -198,10 +212,7 @@ func (s *SqlRoleStore) GetByNames(names []string) ([]*model.Role, error) {
 		return []*model.Role{}, nil
 	}
 
-	query := s.getQueryBuilder().
-		Select("Id, Name, DisplayName, Description, CreateAt, UpdateAt, DeleteAt, Permissions, SchemeManaged, BuiltIn").
-		From("Roles").
-		Where(sq.Eq{"Name": names})
+	query := s.tableSelectQuery.Where(sq.Eq{"Name": names})
 	queryString, args, err := query.ToSql()
 	if err != nil {
 		return nil, errors.Wrap(err, "role_tosql")
@@ -235,7 +246,9 @@ func (s *SqlRoleStore) GetByNames(names []string) ([]*model.Role, error) {
 func (s *SqlRoleStore) Delete(roleId string) (*model.Role, error) {
 	// Get the role.
 	var role Role
-	if err := s.GetReplica().Get(&role, "SELECT * from Roles WHERE Id = ?", roleId); err != nil {
+	query := s.tableSelectQuery.Where(sq.Eq{"Id": roleId})
+
+	if err := s.GetReplica().GetBuilder(&role, query); err != nil {
 		if err == sql.ErrNoRows {
 			return nil, store.NewErrNotFound("Role", roleId)
 		}