Repository navigation
fix(postgrest-js): escape reserved characters in in() and array filters - #2741
mandar1045 wants to merge 1 commit into
Conversation
Filter values containing a double quote or backslash were quoted but not
escaped, and contains/containedBy/overlaps array elements were not quoted at
all. That produced malformed filters that silently matched the wrong rows, e.g.
in('name', ['x,"y']) sent name=in.("x,"y") which PostgREST reads as two values.
Escape " and \ inside quoted values, quote on those characters too, and quote
array elements that contain reserved characters.
Fixes supabase#2740
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (2)
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review. 📝 SummarySummary by CodeRabbit
WalkthroughThe filter builder now escapes embedded double quotes and backslashes in quoted values for Assessment against linked issues
Priority: ➖ Normal Change: Bug fix · Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to The change addresses quoted and reserved characters in filter values. No actionable blocker is established; proceed with normal checks.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This branch has not been deployed
1 participant
Fixes #2740
Filter values with a
"or\were quoted but not escaped, andcontains/containedBy/overlapsarray elements weren't quoted at all — so the query silently matched the wrong rows. e.g.in('name', ['x,"y'])sentname=in.("x,"y"), which PostgREST reads as two values.Escape
"and\inside quoted values, quote on those characters too, and quote array elements containing reserved characters. Added tests; verified round-trip against a real PostgREST.