From 6bf1e54a5013cbb1bf72bc2af63d540f35018042 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Mon, 11 May 2026 17:42:51 +0400
Subject: [PATCH] Fix SQL corruption in FindMatchingPattern by using
 strings.Replace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fmt.Sprintf interprets the literal % characters in the LIKE escape
clause as format verbs, corrupting the query and causing a 500 on
the /report endpoint.  Reorder tracker type / source filters in the
trackers page.

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 .../trackers/CookieBannerTrackersPage.tsx        | 16 ++++++++--------
 pkg/coredata/tracker_pattern.go                  |  3 ++-
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/apps/console/src/pages/organizations/cookie-banners/configuration/trackers/CookieBannerTrackersPage.tsx b/apps/console/src/pages/organizations/cookie-banners/configuration/trackers/CookieBannerTrackersPage.tsx
index 5f7cbb07b..5c31c01c6 100644
--- a/apps/console/src/pages/organizations/cookie-banners/configuration/trackers/CookieBannerTrackersPage.tsx
+++ b/apps/console/src/pages/organizations/cookie-banners/configuration/trackers/CookieBannerTrackersPage.tsx
@@ -168,14 +168,6 @@ export default function CookieBannerTrackersPage({
           onBlur={handleQuerySubmit}
           className="w-72"
         />
-        <Select
-          value={sourceFilter ?? "ALL"}
-          onValueChange={handleSourceFilterChange}
-        >
-          <Option value="ALL">{__("All sources")}</Option>
-          <Option value="SCRIPT">{__("Script")}</Option>
-          <Option value="PRE_EXISTING">{__("Pre-existing")}</Option>
-        </Select>
         <Select
           value={trackerTypeFilter ?? "ALL"}
           onValueChange={handleTrackerTypeFilterChange}
@@ -187,6 +179,14 @@ export default function CookieBannerTrackersPage({
           <Option value="INDEXED_DB">{__("IndexedDB")}</Option>
           <Option value="CACHE_STORAGE">{__("Cache Storage")}</Option>
         </Select>
+        <Select
+          value={sourceFilter ?? "ALL"}
+          onValueChange={handleSourceFilterChange}
+        >
+          <Option value="ALL">{__("All sources")}</Option>
+          <Option value="SCRIPT">{__("Script")}</Option>
+          <Option value="PRE_EXISTING">{__("Pre-existing")}</Option>
+        </Select>
       </div>
 
       <div className={isPending ? "opacity-50 pointer-events-none transition-opacity" : ""}>
diff --git a/pkg/coredata/tracker_pattern.go b/pkg/coredata/tracker_pattern.go
index f39f4b940..4667c8ad4 100644
--- a/pkg/coredata/tracker_pattern.go
+++ b/pkg/coredata/tracker_pattern.go
@@ -19,6 +19,7 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"strings"
 	"time"
 
 	"github.com/jackc/pgx/v5"
@@ -254,7 +255,7 @@ ORDER BY
 LIMIT 1;
 `
 
-	q = fmt.Sprintf(q, scope.SQLFragment())
+	q = strings.Replace(q, "%s", scope.SQLFragment(), 1)
 
 	args := pgx.StrictNamedArgs{
 		"cookie_banner_id": cookieBannerID,