🛡️ Sentinel: [CRITICAL] Fix SQL injection in mobile commands

orch8-api/src/instances.rs

@@ -29,12 +29,12 @@ pub(crate) use bulk::{
     __path_bulk_reschedule, __path_bulk_update_state, __path_list_dlq, bulk_reschedule,
     bulk_update_state, list_dlq,
 };
+pub use checkpoints::{PruneCheckpointsRequest, SaveCheckpointRequest};
 pub(crate) use checkpoints::{
     __path_get_latest_checkpoint, __path_list_checkpoints, __path_prune_checkpoints,
     __path_save_checkpoint, get_latest_checkpoint, list_checkpoints, prune_checkpoints,
     save_checkpoint,
 };
-pub use checkpoints::{PruneCheckpointsRequest, SaveCheckpointRequest};
 pub use inject::InjectBlocksRequest;
 pub(crate) use inject::{__path_inject_blocks, inject_blocks};
 pub(crate) use lifecycle::{

orch8-storage/src/postgres/mobile_sync.rs

@@ -571,20 +571,19 @@ impl crate::MobileSyncStore for PostgresStorage {
         if command_ids.is_empty() {
             return Ok(0);
         }
-        let placeholders: Vec<String> = command_ids
-            .iter()
-            .enumerate()
-            .map(|(i, _)| format!("${}", i + 2))
-            .collect();
-        let sql = format!(
-            "UPDATE mobile_commands SET acked_at = now() WHERE device_id = $1 AND id IN ({})",
-            placeholders.join(",")
+        let mut qb = sqlx::QueryBuilder::new(
+            "UPDATE mobile_commands SET acked_at = now() WHERE device_id = ",
         );
-        let mut query = sqlx::query(&sql).bind(device_id);
+        qb.push_bind(device_id);
+        qb.push(" AND id IN (");
+        let mut separated = qb.separated(", ");
         for id in command_ids {
-            query = query.bind(id);
+            separated.push_bind(id);
         }
-        let result = query
+        separated.push_unseparated(")");
+
+        let result = qb
+            .build()
             .execute(&self.pool)
             .await
             .map_err(|e| StorageError::Query(e.to_string()))?;

orch8-storage/src/sqlite/mod.rs

@@ -2617,16 +2617,19 @@ impl crate::MobileSyncStore for SqliteStorage {
         if command_ids.is_empty() {
             return Ok(0);
         }
-        let placeholders: Vec<&str> = command_ids.iter().map(|_| "?").collect();
-        let sql = format!(
-            "UPDATE mobile_commands SET acked_at = datetime('now') WHERE device_id = ? AND id IN ({})",
-            placeholders.join(",")
+        let mut qb = sqlx::QueryBuilder::new(
+            "UPDATE mobile_commands SET acked_at = datetime('now') WHERE device_id = ",
         );
-        let mut query = sqlx::query(&sql).bind(device_id);
+        qb.push_bind(device_id);
+        qb.push(" AND id IN (");
+        let mut separated = qb.separated(", ");
         for id in command_ids {
-            query = query.bind(id);
+            separated.push_bind(id);
         }
-        let result = query
+        separated.push_unseparated(")");
+
+        let result = qb
+            .build()
             .execute(&self.pool)
             .await
             .map_err(|e| StorageError::Query(e.to_string()))?;