fix: all alerts flagged by CodeQL

api/authenticate.go

@@ -9,15 +9,13 @@ import (
 	"fmt"
 	"net/http"
 
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/token"
 	"github.com/go-vela/server/scm"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types"
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"github.com/sirupsen/logrus"
 )
@@ -247,8 +245,8 @@ func AuthenticateType(c *gin.Context) {
 	logrus.Info("redirecting for final auth flow destination")
 
 	// capture the path elements
-	t := c.Param("type")
-	p := c.Param("port")
+	t := util.PathParameter(c, "type")
+	p := util.PathParameter(c, "port")
 
 	// capture the current query parameters -
 	// they should contain the "code" and "state" values

api/badge.go

@@ -7,13 +7,12 @@ package api
 import (
 	"net/http"
 
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/org"
 	"github.com/go-vela/server/router/middleware/repo"
-
+	"github.com/go-vela/server/util"
 	"github.com/go-vela/types/constants"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -47,7 +46,7 @@ func GetBadge(c *gin.Context) {
 	// capture middleware values
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
-	branch := c.DefaultQuery("branch", r.GetBranch())
+	branch := util.QueryParameter(c, "branch", r.GetBranch())
 
 	// update engine logger with API metadata
 	//

api/deployment.go

@@ -9,17 +9,14 @@ import (
 	"net/http"
 	"strconv"
 
-	"github.com/go-vela/server/router/middleware/org"
-
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
+	"github.com/go-vela/server/router/middleware/org"
 	"github.com/go-vela/server/router/middleware/repo"
 	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/scm"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -305,7 +302,7 @@ func GetDeployment(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	deployment := c.Param("deployment")
+	deployment := util.PathParameter(c, "deployment")
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), deployment)
 

api/hook.go

@@ -10,17 +10,14 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/gin-gonic/gin"
+	"github.com/go-vela/server/database"
 	"github.com/go-vela/server/router/middleware/org"
+	"github.com/go-vela/server/router/middleware/repo"
 	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/scm"
-
-	"github.com/go-vela/server/database"
-	"github.com/go-vela/server/router/middleware/repo"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -305,7 +302,7 @@ func GetHook(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	hook := c.Param("hook")
+	hook := util.PathParameter(c, "hook")
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), hook)
 
@@ -397,7 +394,7 @@ func UpdateHook(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	hook := c.Param("hook")
+	hook := util.PathParameter(c, "hook")
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), hook)
 
@@ -544,7 +541,7 @@ func DeleteHook(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	hook := c.Param("hook")
+	hook := util.PathParameter(c, "hook")
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), hook)
 
@@ -641,7 +638,7 @@ func RedeliverHook(c *gin.Context) {
 	o := org.Retrieve(c)
 	r := repo.Retrieve(c)
 	u := user.Retrieve(c)
-	hook := c.Param("hook")
+	hook := util.PathParameter(c, "hook")
 
 	entry := fmt.Sprintf("%s/%s", r.GetFullName(), hook)
 

api/login.go

@@ -9,9 +9,9 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/go-vela/types"
-
 	"github.com/gin-gonic/gin"
+	"github.com/go-vela/server/util"
+	"github.com/go-vela/types"
 	"github.com/sirupsen/logrus"
 )
 
@@ -43,8 +43,8 @@ func Login(c *gin.Context) {
 	m := c.MustGet("metadata").(*types.Metadata)
 
 	// capture query params
-	t := c.Request.FormValue("type")
-	p := c.Request.FormValue("port")
+	t := util.FormParameter(c, "type")
+	p := util.FormParameter(c, "port")
 
 	// temp variable to hold redirect destination
 	r := ""

api/pipeline/output.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/gin-gonic/gin"
+	"github.com/go-vela/server/util"
 )
 
 const (
@@ -20,7 +21,7 @@ const (
 // request based off the output query parameter provided. If no output
 // query parameter is provided, then YAML is used by default.
 func writeOutput(c *gin.Context, value interface{}) {
-	output := c.DefaultQuery("output", outputYAML)
+	output := util.QueryParameter(c, "output", outputYAML)
 
 	// format response body based off output query parameter
 	switch strings.ToLower(output) {

api/repo.go

@@ -11,18 +11,15 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/go-vela/server/router/middleware/org"
-
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/database"
+	"github.com/go-vela/server/router/middleware/org"
 	"github.com/go-vela/server/router/middleware/repo"
 	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/scm"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types/constants"
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"github.com/sirupsen/logrus"
 )
@@ -462,16 +459,16 @@ func GetRepos(c *gin.Context) {
 // of repos for an org from the configured backend.
 func GetOrgRepos(c *gin.Context) {
 	// capture middleware values
+	o := org.Retrieve(c)
 	u := user.Retrieve(c)
-	org := c.Param("org")
 
 	// update engine logger with API metadata
 	//
 	// https://pkg.go.dev/github.com/sirupsen/logrus?tab=doc#Entry.WithFields
 	logrus.WithFields(logrus.Fields{
-		"org":  org,
+		"org":  o,
 		"user": u.GetName(),
-	}).Infof("reading repos for org %s", org)
+	}).Infof("reading repos for org %s", o)
 
 	// capture page query parameter if present
 	page, err := strconv.Atoi(c.DefaultQuery("page", "1"))
@@ -497,12 +494,12 @@ func GetOrgRepos(c *gin.Context) {
 	perPage = util.MaxInt(1, util.MinInt(100, perPage))
 
 	// capture the sort_by query parameter if present
-	sortBy := c.DefaultQuery("sort_by", "name")
+	sortBy := util.QueryParameter(c, "sort_by", "name")
 
 	// See if the user is an org admin to bypass individual permission checks
-	perm, err := scm.FromContext(c).OrgAccess(u, org)
+	perm, err := scm.FromContext(c).OrgAccess(u, o)
 	if err != nil {
-		logrus.Errorf("unable to get user %s access level for org %s", u.GetName(), org)
+		logrus.Errorf("unable to get user %s access level for org %s", u.GetName(), o)
 	}
 
 	filters := map[string]string{}
@@ -511,22 +508,22 @@ func GetOrgRepos(c *gin.Context) {
 		filters["visibility"] = "public"
 	}
 
-	filters["active"] = c.DefaultQuery("active", "true")
+	filters["active"] = util.QueryParameter(c, "active", "true")
 
 	// send API call to capture the total number of repos for the org
-	t, err := database.FromContext(c).GetOrgRepoCount(org, filters)
+	t, err := database.FromContext(c).GetOrgRepoCount(o, filters)
 	if err != nil {
-		retErr := fmt.Errorf("unable to get repo count for org %s: %w", org, err)
+		retErr := fmt.Errorf("unable to get repo count for org %s: %w", o, err)
 
 		util.HandleError(c, http.StatusInternalServerError, retErr)
 
 		return
 	}
 
 	// send API call to capture the list of repos for the org
-	r, err := database.FromContext(c).GetOrgRepoList(org, filters, page, perPage, sortBy)
+	r, err := database.FromContext(c).GetOrgRepoList(o, filters, page, perPage, sortBy)
 	if err != nil {
-		retErr := fmt.Errorf("unable to get repos for org %s: %w", org, err)
+		retErr := fmt.Errorf("unable to get repos for org %s: %w", o, err)
 
 		util.HandleError(c, http.StatusInternalServerError, retErr)
 

api/secret.go

@@ -11,15 +11,13 @@ import (
 	"strings"
 	"time"
 
+	"github.com/gin-gonic/gin"
 	"github.com/go-vela/server/router/middleware/user"
 	"github.com/go-vela/server/scm"
 	"github.com/go-vela/server/secret"
 	"github.com/go-vela/server/util"
-
 	"github.com/go-vela/types/constants"
 	"github.com/go-vela/types/library"
-
-	"github.com/gin-gonic/gin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -83,10 +81,10 @@ import (
 func CreateSecret(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
+	e := util.PathParameter(c, "engine")
+	t := util.PathParameter(c, "type")
+	o := util.PathParameter(c, "org")
+	n := util.PathParameter(c, "name")
 
 	entry := fmt.Sprintf("%s/%s/%s", t, o, n)
 
@@ -260,10 +258,10 @@ func CreateSecret(c *gin.Context) {
 func GetSecrets(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
+	e := util.PathParameter(c, "engine")
+	t := util.PathParameter(c, "type")
+	o := util.PathParameter(c, "org")
+	n := util.PathParameter(c, "name")
 
 	var teams []string
 	// get list of user's teams if type is shared secret and team is '*'
@@ -428,11 +426,11 @@ func GetSecrets(c *gin.Context) {
 func GetSecret(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
-	s := strings.TrimPrefix(c.Param("secret"), "/")
+	e := util.PathParameter(c, "engine")
+	t := util.PathParameter(c, "type")
+	o := util.PathParameter(c, "org")
+	n := util.PathParameter(c, "name")
+	s := strings.TrimPrefix(util.PathParameter(c, "secret"), "/")
 
 	entry := fmt.Sprintf("%s/%s/%s/%s", t, o, n, s)
 
@@ -548,11 +546,11 @@ func GetSecret(c *gin.Context) {
 func UpdateSecret(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
-	s := strings.TrimPrefix(c.Param("secret"), "/")
+	e := util.PathParameter(c, "engine")
+	t := util.PathParameter(c, "type")
+	o := util.PathParameter(c, "org")
+	n := util.PathParameter(c, "name")
+	s := strings.TrimPrefix(util.PathParameter(c, "secret"), "/")
 
 	entry := fmt.Sprintf("%s/%s/%s/%s", t, o, n, s)
 
@@ -695,11 +693,11 @@ func UpdateSecret(c *gin.Context) {
 func DeleteSecret(c *gin.Context) {
 	// capture middleware values
 	u := user.Retrieve(c)
-	e := c.Param("engine")
-	t := c.Param("type")
-	o := c.Param("org")
-	n := c.Param("name")
-	s := strings.TrimPrefix(c.Param("secret"), "/")
+	e := util.PathParameter(c, "engine")
+	t := util.PathParameter(c, "type")
+	o := util.PathParameter(c, "org")
+	n := util.PathParameter(c, "name")
+	s := strings.TrimPrefix(util.PathParameter(c, "secret"), "/")
 
 	entry := fmt.Sprintf("%s/%s/%s/%s", t, o, n, s)