From 7fb464abc4e79d895a3e81f0025080569a44b1f8 Mon Sep 17 00:00:00 2001 From: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com> Date: Mon, 1 Jun 2026 18:15:02 -0400 Subject: [PATCH] Clean up policy query to use parameter binding for platform filter (#46604) ## Summary - Refactored the conditional access policy query to use `CONCAT('%', ?, '%')` with a bound parameter instead of string concatenation for the platform `LIKE` clause, consistent with how other queries in this file handle string filters. ## Test plan - [ ] Verify conditional access policy lookup still returns correct results for macOS/Windows hosts. - [ ] Confirm no regression in policy filtering behavior. ## Summary by CodeRabbit * **Chores** * Improved platform filtering in conditional access policy queries to enhance query reliability. --- changes/clean-up-policy-query-builder | 1 + server/datastore/mysql/policies.go | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 changes/clean-up-policy-query-builder diff --git a/changes/clean-up-policy-query-builder b/changes/clean-up-policy-query-builder new file mode 100644 index 0000000000..a340bc793b --- /dev/null +++ b/changes/clean-up-policy-query-builder @@ -0,0 +1 @@ +* Updated conditional access policy query to use parameter binding for platform filter. diff --git a/server/datastore/mysql/policies.go b/server/datastore/mysql/policies.go index 3d2dd8d577..5725853c84 100644 --- a/server/datastore/mysql/policies.go +++ b/server/datastore/mysql/policies.go @@ -2538,9 +2538,9 @@ func (ds *Datastore) GetCalendarPolicies(ctx context.Context, teamID uint) ([]fl func (ds *Datastore) GetPoliciesForConditionalAccess(ctx context.Context, teamID uint, platform string) ([]uint, error) { // Currently, the "Conditional access" feature is for macOS hosts only. - query := `SELECT id FROM policies WHERE team_id = ? AND conditional_access_enabled AND (platforms LIKE '%` + platform + `%' OR platforms = '');` + query := `SELECT id FROM policies WHERE team_id = ? AND conditional_access_enabled AND (platforms LIKE CONCAT('%', ?, '%') OR platforms = '');` var policyIDs []uint - err := sqlx.SelectContext(ctx, ds.reader(ctx), &policyIDs, query, teamID) + err := sqlx.SelectContext(ctx, ds.reader(ctx), &policyIDs, query, teamID, platform) if err != nil { return nil, ctxerr.Wrap(ctx, err, "get policies for conditional access") }