Pull request review

Every pull request, read line by line.

acme/payments-apiAdd customer search#482

209 export async function searchCustomers(req: Request) {

210 const q = req.query.q ?? "";

211+ const rows = await db.raw(

212+ `SELECT * FROM customers WHERE name LIKE '%${q}%'`

213+ );

214 return json(rows);

Reading 3 changed lines…

Search filter interpolates q directly into SQL

criticalCWE-89src/api/customers.ts:212

Unbounded result set — no limit on the returned rows

mediumCWE-770src/api/customers.ts:209

Every finding is grounded in the diff — the file, the line, and the reason it matters. No prose about code it never read.

Sign in to Patchlight

Reviews run on your pull requests, so GitHub is how you get in. No password to set.

20 free reviews to start · no card required

By continuing, you agree to the Terms of Use and Privacy Policy applicable to Patchlight.

First time here? Signing in with GitHub creates your account. You'll pick which repositories Patchlight can see on the next step — it never asks for more.