Starstruk Logo MarkStarstruk

v2.1.7

jianchang512/clone-voicev2.1.7Feb 9, 2026by chamikaJ

AI Summary

A critical security release addressing SQL injection vulnerabilities in the backend by introducing a new SqlHelper utility class and refactoring queries to use parameterized queries.

Key Highlights

  • Critical security fixes for SQL injection vulnerabilities
  • New SqlHelper utility class for secure query construction
  • Comprehensive input validation (UUID, colors, sorting fields)
  • Refactoring of 10+ affected files across projects and reporting

New Features

  • Secure SqlHelper utility class
  • Parameterized query refactoring
  • Input validation layers

Full Release Notes

## πŸ”’ Security Release

This is a **critical security release** addressing multiple SQL injection vulnerabilities in the backend. **All users should upgrade immediately.**
Multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting:
- Project and task management controllers
- Reporting and financial data endpoints
- Real-time socket.io handlers
- Resource allocation and scheduling features

### What's Fixed
This release addresses all identified SQL injection vulnerabilities through:

- βœ… **New SqlHelper Utility Class** - Provides secure parameterized query construction methods
- βœ… **Parameterized Query Refactoring** - Converted all 10 affected files to use PostgreSQL parameterized queries
- βœ… **Comprehensive Input Validation** - Added UUID format validation, color code whitelisting, and sort field whitelisting
- βœ… **Eliminated Unsafe Patterns** - Replaced `flatString()` helper and direct string interpolation
- βœ… **Defense-in-Depth** - Multiple validation layers to prevent exploitation

### Affected Components (Fixed in v2.1.7)

| Component | File | Vulnerability Type | Status |
|-----------|------|-------------------|--------|
| Project Categories | `project-categories-controller.ts` | IN clause injection | βœ… Fixed |
| Projects | `projects-controller.ts` | String interpolation | βœ… Fixed |
| Tasks V2 | `tasks-controller-v2.ts` | IN clause injection | βœ… Fixed |
| Project Templates | `pt-tasks-controller.ts` | IN clause injection | βœ… Fixed |
| Workload/Gantt | `workload-gannt-controller.ts` | String interpolation | βœ… Fixed |
| Schedule | `schedule-controller.ts` | Unsafe DELETE, IN clause | βœ… Fixed |
| Reporting - Projects | `reporting-projects-controller.ts` | IN clause injection | βœ… Fixed |
| Reporting - Members | `reporting-members-controller.ts` | Date interpolation | βœ… Fixed |
| Socket.io Timer | `on-task-timer-stop.ts` | String interpolation | βœ… Fixed |