api/store: Fix updateStatus query

Can't parametrize table name
livepeer · Apr 23, 2024 · feb1bb0 · feb1bb0
1 parent 39e9b14
commit feb1bb0
Showing 1 changed file with 7 additions and 5 deletions.
diff --git a/packages/api/src/store/webhook-table.ts b/packages/api/src/store/webhook-table.ts
@@ -49,12 +49,14 @@ export default class WebhookTable extends Table<DBWebhook> {
   }
 
   async updateStatus(id: string, status: DBWebhook["status"]) {
+    const statusStr = JSON.stringify(status);
     const res = await this.db.query(
-      sql`UPDATE ${
-        this.name
-      } SET data = jsonb_set(data, '{status}', case when data->'status' is null then '{}' else data->'status' end || '${JSON.stringify(
-        status
-      )}') WHERE id = '${id}'`
+      sql``
+        .append(`UPDATE ${this.name} `) // table name can't be parameterized, append a raw string
+        .append(
+          sql`SET data = jsonb_set(data, '{status}', case when data->'status' is null then '{}' else data->'status' end || '${statusStr}') `
+        )
+        .append(sql`WHERE id = '${id}'`)
     );
 
     if (res.rowCount < 1) {