linting srql #2661
No reviewers
Labels
No labels
1week
2weeks
Failed compliance check
IP cameras
NATS
Possible security concern
Review effort 1/5
Review effort 2/5
Review effort 3/5
Review effort 4/5
Review effort 5/5
UI
aardvark
accessibility
amd64
api
arm64
auth
back-end
bgp
blog
bug
build
checkers
ci-cd
cleanup
cnpg
codex
core
dependencies
device-management
documentation
duplicate
dusk
ebpf
enhancement
eta 1d
eta 1hr
eta 3d
eta 3hr
feature
fieldsurvey
github_actions
go
good first issue
help wanted
invalid
javascript
k8s
log-collector
mapper
mtr
needs-triage
netflow
network-sweep
observability
oracle
otel
plug-in
proton
python
question
reddit
redhat
research
rperf
rperf-checker
rust
sdk
security
serviceradar-agent
serviceradar-agent-gateway
serviceradar-web
serviceradar-web-ng
siem
snmp
sysmon
topology
ubiquiti
wasm
wontfix
zen-engine
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
carverauto/serviceradar!2661
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "refs/pull/2661/head"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Imported from GitHub pull request.
Original GitHub pull request: #2281
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/2281
Original created: 2026-01-14T03:41:26Z
Original updated: 2026-01-14T03:56:29Z
Original head: carverauto/serviceradar:update/linter_fix
Original base: staging
Original merged: 2026-01-14T03:56:27Z by @mfreeman451
User description
IMPORTANT: Please sign the Developer Certificate of Origin
Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include
a DCO sign-off statement indicating the DCO acceptance in one commit message. Here
is an example DCO Signed-off-by line in a commit message:
Describe your changes
Issue ticket number and link
Code checklist before requesting a review
PR Type
Enhancement
Description
Refactored SRQL translation execution for improved code clarity
Extracted parameter decoding and schema handling into separate functions
Introduced helper functions for SQL execution and response building
Simplified control flow using pipe operators and case expressions
Diagram Walkthrough
File Walkthrough
srql.ex
Extract and refactor SRQL translation execution logicweb-ng/lib/serviceradar_web_ng/srql.ex
execute_translation/2to use pipe operators and extractedparameter handling
execute_translation_with_params/4function to handleschema-based query execution
run_sql/2helper function for direct SQL queries without schemarun_sql_in_schema/3helper function for transactionalschema-based queries
build_translation_response/2helper function to standardizeresponse building
Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2281#issuecomment-3747546888
Original created: 2026-01-14T03:41:58Z
PR Compliance Guide 🔍
Below is a summary of compliance checks for this PR:
No security concerns identified
No security vulnerabilities detected by AI analysis. Human verification advised for critical code.🎫 No ticket provided
Codebase context is not defined
Follow the guide to enable codebase context checks.
Generic: Meaningful Naming and Self-Documenting Code
Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting
Status: Passed
Generic: Secure Logging Practices
Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.
Status: Passed
Generic: Comprehensive Audit Trails
Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.
Status:
No audit logging: The refactored SQL execution path adds no audit log entries for query execution, so it is
unclear whether critical actions are captured with user/tenant context elsewhere.
Referred Code
Generic: Robust Error Handling and Edge Case Management
Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation
Status:
Error context unclear: Database and transaction errors are returned directly (
{:error, reason}) withoutadditional context or logging, and it is unclear whether upstream handling adds actionable
context and monitoring.
Referred Code
Generic: Secure Error Handling
Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.
Status:
DB errors surfaced: The new helpers propagate raw adapter/transaction error reasons (
{:error, reason}) whichmay expose internal database details to callers depending on how these errors are
presented to end users.
Referred Code
Generic: Security-First Input Validation and Data Handling
Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities
Status:
Raw SQL execution: The refactor continues to execute
sqlreceived fromtranslationviaEcto.Adapters.SQL.query/3, so compliance depends on whethertranslation["sql"]is guaranteed to be generated server-side and not user-controlled.
Referred Code
Compliance status legend
🟢 - Fully Compliant🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label
Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2281#issuecomment-3747549351
Original created: 2026-01-14T03:42:49Z
PR Code Suggestions ✨
Explore these optional code suggestions:
Fix SQL injection in search_path
Fix a SQL injection vulnerability by using a parameterized query instead of
string interpolation when setting the
search_path.web-ng/lib/serviceradar_web_ng/srql.ex [331-334]
[To ensure code accuracy, apply this suggestion manually]Suggestion importance[1-10]: 10
__
Why: The suggestion correctly identifies a critical SQL injection vulnerability in setting the
search_pathand provides an appropriate fix using parameterized queries.Handle SQL call exceptions
Improve error handling in
run_sql/2by wrapping theEcto.Adapters.SQL.query/3call in a
try/rescueblock to catch and return any unexpected exceptions as anerror tuple.
web-ng/lib/serviceradar_web_ng/srql.ex [337-339]
Suggestion importance[1-10]: 5
__
Why: The suggestion improves robustness by catching potential exceptions from the database adapter, but
Ectofunctions typically return error tuples rather than raising, so the impact is moderate.