Harden projects_first_in (#1836)
Harden projects_first_in (#1836)

* Harden projects_first_in

Harden the method projects_first_in to ensure there's no
SQL injection vulnerability.

Method projects_first_in uses a parameter to create a
SQL query. That parameter should already have been tested by
this point, but Brakeman (at least) can't confirm that,
and if the code changed this could become a security vulnerability.
So instead, first check if "level" is one of the short list
of valid values. That will prevent this from becoming a SQL
injection *even if* level can be somehow set by an attacker.

We can't use use SQL parameterized statements here because the
field names are getting created at run time, and parameterized
statements typically have trouble with field names created at run time.

Signed-off-by: David A. Wheeler <9ae72d22d8b894b865a7a496af4fab6320e6abb2@dwheeler.com>
linuxfoundation/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,coreinfrastructure/best-practices-badge,coreinfrastructure/best-practices-badge,linuxfoundation/cii-best-practices-badge,coreinfrastructure/best-practices-badge,coreinfrastructure/best-practices-badge