chore: resolve sql injection vulnerabilities

package.json

@@ -108,6 +108,7 @@
     "rudder-transformer-cdk": "^1.4.11",
     "set-value": "^4.1.0",
     "sha256": "^0.2.0",
+    "sqlstring": "^2.3.3",
     "stacktrace-parser": "^0.1.10",
     "statsd-client": "^0.4.7",
     "truncate-utf8-bytes": "^1.0.2",

src/v0/destinations/google_adwords_enhanced_conversions/networkHandler.js

@@ -1,6 +1,7 @@
 const { get, set } = require('lodash');
 const sha256 = require('sha256');
 const { NetworkError, NetworkInstrumentationError } = require('@rudderstack/integrations-lib');
+const SqlString = require('sqlstring');
 const { prepareProxyRequest, handleHttpRequest } = require('../../../adapters/network');
 const { isHttpStatusSuccess, getAuthErrCategoryFromStCode } = require('../../util/index');
 const { CONVERSION_ACTION_ID_CACHE_TTL } = require('./config');
@@ -29,8 +30,12 @@ const ERROR_MSG_PATH = 'response[0].error.message';
 const getConversionActionId = async (method, headers, params) => {
   const conversionActionIdKey = sha256(params.event + params.customerId).toString();
   return conversionActionIdCache.get(conversionActionIdKey, async () => {
+    const queryString = SqlString.format(
+      'SELECT conversion_action.id FROM conversion_action WHERE conversion_action.name = ?',
+      [params.event],
+    );
     const data = {
-      query: `SELECT conversion_action.id FROM conversion_action WHERE conversion_action.name = '${params.event}'`,
+      query: queryString,
     };
     const requestBody = {
       url: `${BASE_ENDPOINT}/${params.customerId}/googleAds:searchStream`,

src/v0/destinations/google_adwords_offline_conversions/utils.js

@@ -1,4 +1,5 @@
 const sha256 = require('sha256');
+const SqlString = require('sqlstring');
 const { get, set, cloneDeep } = require('lodash');
 const {
   AbortedError,
@@ -53,8 +54,12 @@ const validateDestinationConfig = ({ Config }) => {
 const getConversionActionId = async (headers, params) => {
   const conversionActionIdKey = sha256(params.event + params.customerId).toString();
   return conversionActionIdCache.get(conversionActionIdKey, async () => {
+    const queryString = SqlString.format(
+      'SELECT conversion_action.id FROM conversion_action WHERE conversion_action.name = ?',
+      [params.event],
+    );
     const data = {
-      query: `SELECT conversion_action.id FROM conversion_action WHERE conversion_action.name = '${params.event}'`,
+      query: queryString,
     };
     const endpoint = SEARCH_STREAM.replace(':customerId', params.customerId);
     const requestOptions = {