fix(security): close backend merge blockers

app/native/wndb/s0_base.py

@@ -1,3 +1,4 @@
+from psycopg import sql
 from psycopg.rows import dict_row, Row
 from .connection import project_connection
 from .database import read
@@ -49,7 +50,12 @@ ELEMENT_TYPES : dict[str, int] = {
 def _get_from(name: str, id: str, base_type: str) -> Row | None:
     with project_connection(name) as conn:
         with conn.cursor(row_factory=dict_row) as cur:
-            cur.execute(f"select * from {base_type} where id = '{id}'")
+            cur.execute(
+                sql.SQL("select * from {} where id = %s").format(
+                    sql.Identifier(base_type)
+                ),
+                (id,),
+            )
             return cur.fetchone()
 
 
@@ -243,11 +249,17 @@ def get_node_links(name: str, id: str) -> list[str]:
     with project_connection(name) as conn:
         with conn.cursor(row_factory=dict_row) as cur:
             links: list[str] = []
-            for p in cur.execute(f"select id from pipes where node1 = '{id}' or node2 = '{id}'").fetchall():
+            for p in cur.execute(
+                "select id from pipes where node1 = %s or node2 = %s", (id, id)
+            ).fetchall():
                 links.append(p['id'])
-            for p in cur.execute(f"select id from pumps where node1 = '{id}' or node2 = '{id}'").fetchall():
+            for p in cur.execute(
+                "select id from pumps where node1 = %s or node2 = %s", (id, id)
+            ).fetchall():
                 links.append(p['id'])
-            for p in cur.execute(f"select id from valves where node1 = '{id}' or node2 = '{id}'").fetchall():
+            for p in cur.execute(
+                "select id from valves where node1 = %s or node2 = %s", (id, id)
+            ).fetchall():
                 links.append(p['id'])
             return links
 
@@ -255,16 +267,15 @@ def get_node_links(name: str, id: str) -> list[str]:
 def get_link_nodes(name: str, id: str) -> list[str]:
     row = {}
     if is_pipe(name, id):
-        row = read(name, f"select node1, node2 from pipes where id = '{id}'")
+        row = read(name, "select node1, node2 from pipes where id = %s", (id,))
     elif is_pump(name, id):
-        row = read(name, f"select node1, node2 from pumps where id = '{id}'")
+        row = read(name, "select node1, node2 from pumps where id = %s", (id,))
     elif is_valve(name, id):
-        row = read(name, f"select node1, node2 from valves where id = '{id}'")
+        row = read(name, "select node1, node2 from valves where id = %s", (id,))
     return [str(row['node1']), str(row['node2'])]
 
 def get_region_type(name: str, id: str)->str:
     if(is_region(name,id)):
-        type = read(name, f"select type from _region where id = '{id}'")
+        type = read(name, "select type from _region where id = %s", (id,))
         return type
 
-