Repository: louislam/uptime-kuma
File: server/uptime-kuma-server.js (JavaScript)

Code before:
    }

    /**
     * Delete Monitor from list
     * @param {Socket} socket Socket to send list on
     * @param {number} monitorID update or deleted monitor id
     * @returns {Promise<void>}
     */
    async sendDeleteMonitorFromList(socket, monitorID) {
        this.io.to(socket.userID).emit("deleteMonitorFromList", monitorID);
    }

    /**
     * Get a list of monitors for the given user.
     * @param {string} userID - The ID of the user to get monitors for.
     * @param {number[]} monitorIDs - The IDs of monitors for.
     * @returns {Promise<object>} A promise that resolves to an object with monitor IDs as keys and monitor objects as values.
     *
     * Generated by Trelent
     */
    async getMonitorJSONList(userID, monitorIDs = null) {

        let query = " user_id = ? ";

        if (monitorIDs) {
            query += `AND id IN (${monitorIDs.join(",")}) `;
        }

        let monitorList = await R.find("monitor", query + "ORDER BY weight DESC, name", [ userID ]);

        const monitorData = monitorList.map(monitor => ({
            id: monitor.id,
            active: monitor.active,
            name: monitor.name,
        }));
        const preloadData = await Monitor.preparePreloadData(monitorData);

        const result = {};
        monitorList.forEach(monitor => result[monitor.id] = monitor.toJSON(preloadData));
        return result;
    }

    /**
     * Send maintenance list to client
     * @param {Socket} socket Socket.io instance to send to
     * @returns {Promise<object>} Maintenance list
     */
    async sendMaintenanceList(socket) {
        return await this.sendMaintenanceListByUserID(socket.userID);
    }


Review comment (security):
Please see https://wikipedia.org/wiki/SQL_injection why parametrisation as in the previous code is nessesary

Code after:
     * @param {Socket} socket Socket to send list on
     * @param {number} monitorID update or deleted monitor id
     * @returns {Promise<void>}
     */
    async sendDeleteMonitorFromList(socket, monitorID) {
        this.io.to(socket.userID).emit("deleteMonitorFromList", monitorID);
    }

    /**
     * Get a list of monitors for the given user.
     * @param {string} userID - The ID of the user to get monitors for.
     * @param {number} monitorID - The ID of monitor for.
     * @returns {Promise<object>} A promise that resolves to an object with monitor IDs as keys and monitor objects as values.
     *
     * Generated by Trelent
     */
    async getMonitorJSONList(userID, monitorID = null) {

        let query = " user_id = ? ";
        let queryParams = [ userID ];

        if (monitorID) {
            query += "AND id = ? ";
            queryParams.push(monitorID);
        }

        let monitorList = await R.find("monitor", query + "ORDER BY weight DESC, name", queryParams);

        const monitorData = monitorList.map(monitor => ({
            id: monitor.id,
            active: monitor.active,
            name: monitor.name,
        }));
        const preloadData = await Monitor.preparePreloadData(monitorData);

        const result = {};
        monitorList.forEach(monitor => result[monitor.id] = monitor.toJSON(preloadData));
        return result;
    }

    /**
     * Send maintenance list to client
     * @param {Socket} socket Socket.io instance to send to
     * @returns {Promise<object>} Maintenance list
     */
    async sendMaintenanceList(socket) {
        return await this.sendMaintenanceListByUserID(socket.userID);
    }

    /**
     * Send list of maintenances to user