From 44da5d09c581e54f94ad989b9a411e3c35219de5 Mon Sep 17 00:00:00 2001
From: Johan Haals <johan.haals@gmail.com>
Date: Mon, 8 Feb 2021 09:24:48 +0100
Subject: [PATCH] scaffolder: Convert to prepared statements

---
 .../src/scaffolder/tasks/DatabaseTaskStore.ts              | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/DatabaseTaskStore.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/DatabaseTaskStore.ts
index 373a4486f1..5717f3c8c1 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/DatabaseTaskStore.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/DatabaseTaskStore.ts
@@ -158,8 +158,11 @@ export class DatabaseTaskStore implements TaskStore {
         'last_heartbeat_at',
         '<=',
         this.db.client.config.client === 'sqlite3'
-          ? this.db.raw(`datetime('now', '-${Number(timeoutS)} seconds')`)
-          : this.db.raw(`dateadd('second', -${Number(timeoutS)}, now())`),
+          ? this.db.raw(`datetime('now', ?)`, [`-${timeoutS} seconds`])
+          : this.db.raw(`dateadd('second', ?, ?)`, [
+              `-${timeoutS}`,
+              this.db.fn.now(),
+            ]),
       );
     const tasks = rawRows.map(row => ({
       taskId: row.id,