Task: Replace $executeRawUnsafe with Safe Parameterized Query #348

New issue

Open

opened 2026-02-28 00:14:32 +00:00 by jjalangtry · 0 comments

jjalangtry commented

2026-02-28 00:14:32 +00:00

(Migrated from github.com)

Replace $executeRawUnsafe with Safe Parameterized Query

Description

next/app/api/alumni-requests/route.ts line 156 uses prisma.$executeRawUnsafe() to reset a PostgreSQL sequence. Although the string is currently hardcoded and not user-influenced, $executeRawUnsafe is categorically unsafe: it bypasses Prisma parameterization and any future edit that interpolates a variable would introduce SQL injection. The codebase should have zero uses of $executeRawUnsafe.

Associated Epic: #346

Subtasks

Open next/app/api/alumni-requests/route.ts, locate line 156:
await prisma.$executeRawUnsafe('SELECT setval("Alumni_id_seq", GREATEST((SELECT MAX(id) FROM "Alumni"), 1))')
Replace with the prisma.$executeRaw tagged template literal form:
await prisma.$executeRaw'SELECT setval("Alumni_id_seq", GREATEST((SELECT MAX(id) FROM "Alumni"), 1))'
Audit the rest of the codebase for any other $executeRawUnsafe or $queryRawUnsafe calls and replace them
Add a lint rule or comment to prevent future use of $executeRawUnsafe

Acceptance Criteria

Zero occurrences of $executeRawUnsafe or $queryRawUnsafe anywhere in next/app/ or next/lib/
The alumni request approval flow still works correctly end-to-end after the change

# Replace $executeRawUnsafe with Safe Parameterized Query ## Description next/app/api/alumni-requests/route.ts line 156 uses prisma.$executeRawUnsafe() to reset a PostgreSQL sequence. Although the string is currently hardcoded and not user-influenced, $executeRawUnsafe is categorically unsafe: it bypasses Prisma parameterization and any future edit that interpolates a variable would introduce SQL injection. The codebase should have zero uses of $executeRawUnsafe. Associated Epic: #346 ## Subtasks - [ ] Open next/app/api/alumni-requests/route.ts, locate line 156: await prisma.$executeRawUnsafe('SELECT setval("Alumni_id_seq", GREATEST((SELECT MAX(id) FROM "Alumni"), 1))') - [ ] Replace with the prisma.$executeRaw tagged template literal form: await prisma.$executeRaw'SELECT setval("Alumni_id_seq", GREATEST((SELECT MAX(id) FROM "Alumni"), 1))' - [ ] Audit the rest of the codebase for any other $executeRawUnsafe or $queryRawUnsafe calls and replace them - [ ] Add a lint rule or comment to prevent future use of $executeRawUnsafe ## Acceptance Criteria - [ ] Zero occurrences of $executeRawUnsafe or $queryRawUnsafe anywhere in next/app/ or next/lib/ - [ ] The alumni request approval flow still works correctly end-to-end after the change