Language: Go
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
func (m *ProjectManager) ListProjects(ctx context.Context, request admin.ProjectListRequest) (*admin.Projects, error) {
	spec := util.FilterSpec{
		RequestFilters: request.Filters,
	}
	filters, err := util.GetDbFilters(spec, common.Project)
	if err != nil {
		return nil, err
	}

	var sortParameter common.SortParameter
	if request.SortBy != nil {
		sortParameter, err = common.NewSortParameter(*request.SortBy)
		if err != nil {
			return nil, err
		}
	} else {
		sortParameter = alphabeticalSortParam
	}

	offset, err := validation.ValidateToken(request.Token)
	if err != nil {
		return nil, errors.NewFlyteAdminErrorf(codes.InvalidArgument,
			"invalid pagination token %s for ListProjects", request.Token)
	}

	// And finally, query the database
	listProjectsInput := repoInterfaces.ListResourceInput{
		Limit:         int(request.Limit),
		Offset:        offset,
		InlineFilters: filters,
		SortParameter: sortParameter,
	}
	projectModels, err := m.db.ProjectRepo().List(ctx, listProjectsInput)
	if err != nil {
		return nil, err
	}
	projects := transformers.FromProjectModels(projectModels, m.getDomains())

	var token string
	if len(projects) == int(request.Limit) {
		token = strconv.Itoa(offset + len(projects))
	}

	return &admin.Projects{
		Projects: projects,
		Token:    token,
	}, nil
}