Cherry pick prisma query protection.

lib/prisma.ts

@@ -54,7 +54,19 @@ function getClient(options) {
   return prisma;
 }
 
-function getDateQuery(field, unit, timezone?): string {
+function toUuid(): string {
+  const db = getDatabaseType(process.env.DATABASE_URL);
+
+  if (db === POSTGRESQL) {
+    return '::uuid';
+  }
+
+  if (db === MYSQL) {
+    return '';
+  }
+}
+
+function getDateQuery(field: string, unit: string, timezone?: string): string {
   const db = getDatabaseType(process.env.DATABASE_URL);
 
   if (db === POSTGRESQL) {
@@ -201,7 +213,7 @@ function parseFilters(
     event: { event_name },
     joinSession:
       os || browser || device || country
-        ? `inner join session on ${sessionKey} = session.${sessionKey}`
+        ? `inner join session on website_event.${sessionKey} = session.${sessionKey}`
         : '',
     filterQuery: getFilterQuery(filters, params),
   };
@@ -235,6 +247,7 @@ export default {
   getFilterQuery,
   getEventDataColumnsQuery,
   getEventDataFilterQuery,
+  toUuid,
   parseFilters,
   rawQuery,
   transaction,

pages/api/websites/[id]/pageviews.ts

@@ -82,7 +82,7 @@ export default async (
         endDate,
         timezone: tz,
         unit,
-        count: 'distinct pageview.',
+        count: 'distinct website_event.',
         filters: {
           url,
           os,

queries/analytics/event/getEventData.ts

@@ -38,17 +38,17 @@ async function relationalQuery(
   },
 ) {
   const { startDate, endDate, eventName, columns, filters } = data;
-  const { rawQuery, getEventDataColumnsQuery, getEventDataFilterQuery } = prisma;
+  const { toUuid, rawQuery, getEventDataColumnsQuery, getEventDataFilterQuery } = prisma;
-  const params = [startDate, endDate];
+  const params: any = [websiteId, startDate, endDate, eventName];
 
   return rawQuery(
     `select
       ${getEventDataColumnsQuery('event_data', columns)}
     from website_event
-    where website_id ='${websiteId}'
+    where website_id = $1${toUuid()}
-      and created_at between $1 and $2
+      and created_at between $2 and $3
       and event_type = ${EVENT_TYPE.customEvent}
-      ${eventName ? `and eventName = ${eventName}` : ''}
+      ${eventName ? `and eventName = $4` : ''}
       ${
         Object.keys(filters).length > 0
           ? `and ${getEventDataFilterQuery('event_data', filters)}`

queries/analytics/event/getEventMetrics.ts

@@ -45,8 +45,8 @@ async function relationalQuery(
     };
   },
 ) {
-  const { rawQuery, getDateQuery, getFilterQuery } = prisma;
+  const { toUuid, rawQuery, getDateQuery, getFilterQuery } = prisma;
-  const params = [startDate, endDate];
+  const params: any = [websiteId, startDate, endDate];
 
   return rawQuery(
     `select
@@ -54,8 +54,8 @@ async function relationalQuery(
       ${getDateQuery('created_at', unit, timezone)} t,
       count(*) y
     from website_event
-    where website_id='${websiteId}'
+    where website_id = $1${toUuid()}
-      and created_at between $1 and $2
+      and created_at between $2 and $3
       and event_type = ${EVENT_TYPE.customEvent}
       ${getFilterQuery(filters, params)}
     group by 1, 2

queries/analytics/pageview/getPageviewMetrics.ts

@@ -32,18 +32,23 @@ async function relationalQuery(
     filters: object;
   },
 ) {
-  const { startDate, endDate, column, filters = {} } = data;
+  const { startDate, endDate, column, filters = {}, type } = data;
-  const { rawQuery, parseFilters } = prisma;
+  const { rawQuery, parseFilters, toUuid } = prisma;
-  const params = [startDate, endDate];
+  const params: any = [
+    websiteId,
+    startDate,
+    endDate,
+    type === 'event' ? EVENT_TYPE.customEvent : EVENT_TYPE.pageView,
+  ];
   const { filterQuery, joinSession } = parseFilters(filters, params);
 
   return rawQuery(
     `select ${column} x, count(*) y
     from website_event
       ${joinSession}
-    where website_id='${websiteId}'
+    where website_event.website_id = $1${toUuid()}
-      and website_event.created_at between $1 and $2
+      and website_event.created_at between $2 and $3
-      and event_type = ${EVENT_TYPE.pageView}
+      and event_type = $4
       ${filterQuery}
     group by 1
     order by 2 desc`,

queries/analytics/pageview/getPageviewStats.ts

@@ -45,8 +45,8 @@ async function relationalQuery(
     filters = {},
     sessionKey = 'session_id',
   } = data;
-  const { getDateQuery, parseFilters, rawQuery } = prisma;
+  const { toUuid, getDateQuery, parseFilters, rawQuery } = prisma;
-  const params = [startDate, endDate];
+  const params: any = [websiteId, startDate, endDate];
   const { filterQuery, joinSession } = parseFilters(filters, params);
 
   return rawQuery(
@@ -54,8 +54,8 @@ async function relationalQuery(
         count(${count !== '*' ? `${count}${sessionKey}` : count}) y
       from website_event
         ${joinSession}
-      where website.website_id='${websiteId}'
+      where website_event.website_id = $1${toUuid()}
-        and pageview.created_at between $1 and $2
+        and website_event.created_at between $2 and $3
         and event_type = ${EVENT_TYPE.pageView}
         ${filterQuery}
       group by 1`,
@@ -90,7 +90,7 @@ async function clickhouseQuery(
         ${getDateQuery('created_at', unit, timezone)} t,
         count(${count !== '*' ? 'distinct session_id' : count}) y
       from event
-      where website_id = $1      
+      where website_id = $1 
         and rev_id = $2  
         and event_type = ${EVENT_TYPE.pageView}
         and ${getBetweenDates('created_at', startDate, endDate)}

queries/analytics/session/getSessionMetrics.ts

@@ -20,21 +20,21 @@ async function relationalQuery(
   data: { startDate: Date; endDate: Date; field: string; filters: object },
 ) {
   const { startDate, endDate, field, filters = {} } = data;
-  const { parseFilters, rawQuery } = prisma;
+  const { toUuid, parseFilters, rawQuery } = prisma;
-  const params = [startDate, endDate];
+  const params: any = [websiteId, startDate, endDate];
   const { filterQuery, joinSession } = parseFilters(filters, params);
 
   return rawQuery(
     `select ${field} x, count(*) y
     from session as x
     where x.session_id in (
-      select pageview.session_id
+      select website_event.session_id
-      from pageview
+      from website_event
         join website 
-          on pageview.website_id = website.website_id
+          on website_event.website_id = website.website_id
         ${joinSession}
-      where website.website_id='${websiteId}'
+      where website.website_id = $1${toUuid()}
-      and pageview.created_at between $1 and $2
+      and website_event.created_at between $2 and $3
       ${filterQuery}
     )
     group by 1

queries/analytics/stats/getActiveVisitors.ts

@@ -11,16 +11,18 @@ export async function getActiveVisitors(...args: [websiteId: string]) {
 }
 
 async function relationalQuery(websiteId: string) {
-  const date = subMinutes(new Date(), 5);
+  const { toUuid, rawQuery } = prisma;
-  const params = [date];
 
-  return prisma.rawQuery(
+  const date = subMinutes(new Date(), 5);
+  const params: any = [websiteId, date];
+
+  return rawQuery(
     `select count(distinct session_id) x
-    from pageview
+    from website_event
       join website 
-        on pageview.website_id = website.website_id
+        on website_event.website_id = website.website_id
-    where website.website_id = '${websiteId}'
+    where website.website_id = $1${toUuid()}
-    and pageview.created_at >= $1`,
+    and website_event.created_at >= $2`,
     params,
   );
 }

queries/analytics/stats/getWebsiteStats.ts

@@ -2,6 +2,7 @@ import prisma from 'lib/prisma';
 import clickhouse from 'lib/clickhouse';
 import { runQuery, CLICKHOUSE, PRISMA } from 'lib/db';
 import cache from 'lib/cache';
+import { EVENT_TYPE } from 'lib/constants';
 
 export async function getWebsiteStats(
   ...args: [websiteId: string, data: { startDate: Date; endDate: Date; filters: object }]
@@ -17,8 +18,8 @@ async function relationalQuery(
   data: { startDate: Date; endDate: Date; filters: object },
 ) {
   const { startDate, endDate, filters = {} } = data;
-  const { getDateQuery, getTimestampInterval, parseFilters, rawQuery } = prisma;
+  const { toUuid, getDateQuery, getTimestampInterval, parseFilters, rawQuery } = prisma;
-  const params = [startDate, endDate];
+  const params: any = [websiteId, startDate, endDate];
   const { filterQuery, joinSession } = parseFilters(filters, params);
 
   return rawQuery(
@@ -27,16 +28,16 @@ async function relationalQuery(
         sum(case when t.c = 1 then 1 else 0 end) as "bounces",
         sum(t.time) as "totaltime"
       from (
-        select pageview.session_id,
+        select website_event.session_id,
-          ${getDateQuery('pageview.created_at', 'hour')},
+          ${getDateQuery('website_event.created_at', 'hour')},
           count(*) c,
-          ${getTimestampInterval('pageview.created_at')} as "time"
+          ${getTimestampInterval('website_event.created_at')} as "time"
-        from pageview
+        from website_event
           join website 
-            on pageview.website_id = website.website_id
+            on website_event.website_id = website.website_id
           ${joinSession}
-        where website.website_id='${websiteId}'
+        where website.website_id = $1${toUuid()}
-          and pageview.created_at between $1 and $2
+          and website_event.created_at between $2 and $3
           ${filterQuery}
         group by 1, 2
      ) t`,
@@ -67,7 +68,7 @@ async function clickhouseQuery(
          min(created_at) min_time,
          max(created_at) max_time
        from event
-       where event_name = ''
+       where event_type = ${EVENT_TYPE.pageView}
          and website_id = $1
          and rev_id = $2
          and ${getBetweenDates('created_at', startDate, endDate)}