Potential SQL injection via string-based query concatenation

[tolgaOzen]

Find more live information in Aikido here: https://app.aikido.dev/queue?sidebarIssue=4226131&groupId=6798&sidebarIssueTask=109779&sidebarTab=tasks

==== Scope ====
This task includes issues in the following code repository:

• permify: internal/storage/postgres/gc/gc.go

==== TLDR ====
SQL injection might be possible in these locations, especially if the strings being concatenated are controlled via user input.

==== How to fix ====
If possible, rebuild the query to use prepared statements or an ORM. If that is not possible, make sure the user input is whitelisted or sanitized. As an added layer of protection, we also recommend installing a WAF that blocks SQL injection attacks.