Fix SQL corruption in FindMatchingPattern by using strings.Replace

fmt.Sprintf interprets the literal % characters in the LIKE escape
clause as format verbs, corrupting the query and causing a 500 on
the /report endpoint.  Reorder tracker type / source filters in the
trackers page.

Signed-off-by: Émile Ré <emile@getprobo.com>

apps/console/src/pages/organizations/cookie-banners/configuration/trackers/CookieBannerTrackersPage.tsx

@@ -168,14 +168,6 @@ export default function CookieBannerTrackersPage({
           onBlur={handleQuerySubmit}
           className="w-72"
         />
-        <Select
-          value={sourceFilter ?? "ALL"}
-          onValueChange={handleSourceFilterChange}
-        >
-          <Option value="ALL">{__("All sources")}</Option>
-          <Option value="SCRIPT">{__("Script")}</Option>
-          <Option value="PRE_EXISTING">{__("Pre-existing")}</Option>
-        </Select>
         <Select
           value={trackerTypeFilter ?? "ALL"}
           onValueChange={handleTrackerTypeFilterChange}
@@ -187,6 +179,14 @@ export default function CookieBannerTrackersPage({
           <Option value="INDEXED_DB">{__("IndexedDB")}</Option>
           <Option value="CACHE_STORAGE">{__("Cache Storage")}</Option>
         </Select>
+        <Select
+          value={sourceFilter ?? "ALL"}
+          onValueChange={handleSourceFilterChange}
+        >
+          <Option value="ALL">{__("All sources")}</Option>
+          <Option value="SCRIPT">{__("Script")}</Option>
+          <Option value="PRE_EXISTING">{__("Pre-existing")}</Option>
+        </Select>
       </div>
 
       <div className={isPending ? "opacity-50 pointer-events-none transition-opacity" : ""}>

pkg/coredata/tracker_pattern.go

@@ -19,6 +19,7 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"strings"
 	"time"
 
 	"github.com/jackc/pgx/v5"
@@ -254,7 +255,7 @@ ORDER BY
 LIMIT 1;
 `
 
-	q = fmt.Sprintf(q, scope.SQLFragment())
+	q = strings.Replace(q, "%s", scope.SQLFragment(), 1)
 
 	args := pgx.StrictNamedArgs{
 		"cookie_banner_id": cookieBannerID,