Language: Go
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
func (s *SignalManager) ListSignals(ctx context.Context, request admin.SignalListRequest) (*admin.SignalList, error) {
	if err := validation.ValidateSignalListRequest(ctx, request); err != nil {
		logger.Debugf(ctx, "ListSignals request [%+v] is invalid: %v", request, err)
		return nil, err
	}
	ctx = getExecutionContext(ctx, request.WorkflowExecutionId)

	identifierFilters, err := util.GetWorkflowExecutionIdentifierFilters(ctx, *request.WorkflowExecutionId)
	if err != nil {
		return nil, err
	}

	filters, err := util.AddRequestFilters(request.Filters, common.Signal, identifierFilters)
	if err != nil {
		return nil, err
	}
	var sortParameter common.SortParameter
	if request.SortBy != nil {
		sortParameter, err = common.NewSortParameter(*request.SortBy)
		if err != nil {
			return nil, err
		}
	}

	offset, err := validation.ValidateToken(request.Token)
	if err != nil {
		return nil, errors.NewFlyteAdminErrorf(codes.InvalidArgument,
			"invalid pagination token %s for ListSignals", request.Token)
	}

	signalModelList, err := s.db.SignalRepo().List(ctx, repoInterfaces.ListResourceInput{
		InlineFilters: filters,
		Offset:        offset,
		Limit:         int(request.Limit),
		SortParameter: sortParameter,
	})
	if err != nil {
		logger.Debugf(ctx, "Failed to list signals with request [%+v] with err %v",
			request, err)
		return nil, err
	}

	signalList, err := transformers.FromSignalModels(signalModelList)
	if err != nil {
		logger.Debugf(ctx, "failed to transform signal models for request [%+v] with err: %v", request, err)
		return nil, err
	}
	var token string
	if len(signalList) == int(request.Limit) {
		token = strconv.Itoa(offset + len(signalList))
	}
	return &admin.SignalList{
		Signals: signalList,
		Token:   token,
	}, nil
}