LOW: LIVE constant interpolated into SQL queries in payments.js #81

New Issue

Closed

opened 2026-05-31 12:03:59 -05:00 by null · 0 comments

null commented

2026-05-31 12:03:59 -05:00

Owner

Bug Description

routes/payments.js:9 defines const LIVE = deleted_at IS NULL and interpolates it into multiple SQL queries via template literals (e.g., ...p.${LIVE}...). While the value is hardcoded and not user-controlled, this pattern makes future modifications riskier. A parameterized approach would be safer by construction.

Affected Files

routes/payments.js:9, 86, 107, 363, 420, 440

Recommended Fix

Replace with a parameterized approach or at minimum add a comment explaining the constant is intentionally hardcoded.

## Bug Description routes/payments.js:9 defines const LIVE = deleted_at IS NULL and interpolates it into multiple SQL queries via template literals (e.g., ...p.${LIVE}...). While the value is hardcoded and not user-controlled, this pattern makes future modifications riskier. A parameterized approach would be safer by construction. ## Affected Files - routes/payments.js:9, 86, 107, 363, 420, 440 ## Recommended Fix Replace with a parameterized approach or at minimum add a comment explaining the constant is intentionally hardcoded.