security fixes

[mornyx]

• Two SQL injection vulnerabilities
• The middleware is not aborted after JWT validation failure

[netlify[bot]]

✅ Deploy Preview for tidb-dashboard canceled.

Name	Link
🔨 Latest commit	ca41da2a69f8213deda67d7d365419fe96075b27
🔍 Latest deploy log	https://app.netlify.com/sites/tidb-dashboard/deploys/6503d3684b59340008fc8043

[codecov[bot]]

Codecov Report

Merging #1592 (ca41da2) into master (2fe49a6) will decrease coverage by 0.01%. The diff coverage is 0.00%.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #1592 +/- ## ========================================== - Coverage 24.71% 24.70% -0.01% ========================================== Files 169 169 Lines 15211 15216 +5 ========================================== Hits 3759 3759 - Misses 11170 11175 +5 Partials 282 282 ``` | [Flag](https://app.codecov.io/gh/pingcap/tidb-dashboard/pull/1592/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pingcap) | Coverage Δ | | |---|---|---| | [backend_integration](https://app.codecov.io/gh/pingcap/tidb-dashboard/pull/1592/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pingcap) | `9.31% <0.00%> (-0.01%)` | :arrow_down: | | [backend_ut](https://app.codecov.io/gh/pingcap/tidb-dashboard/pull/1592/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pingcap) | `26.41% <0.00%> (ø)` | | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pingcap#carryforward-flags-in-the-pull-request-comment) to find out more. ------ [Continue to review full report in Codecov by Sentry](https://app.codecov.io/gh/pingcap/tidb-dashboard/pull/1592?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pingcap). > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pingcap) > `Δ = absolute (impact)`, `ø = not affected`, `? = missing data` > Powered by [Codecov](https://app.codecov.io/gh/pingcap/tidb-dashboard/pull/1592?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pingcap). Last update [2fe49a6...ca41da2](https://app.codecov.io/gh/pingcap/tidb-dashboard/pull/1592?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pingcap). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pingcap).

[ti-chi-bot[bot]]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: shhdgit

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/pingcap/tidb-dashboard/blob/master/OWNERS)~~ [shhdgit] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

[ti-chi-bot[bot]]

[LGTM Timeline notifier]

Timeline:

• 2023-09-15 03:51:28.945300132 +0000 UTC m=+230254.912888168: :ballot_box_with_check: agreed by shhdgit.