fix(postgrest): escape array-literal elements in cs/cd/contains/contained_by/overlaps - #1593
Open
eeshsaxena wants to merge 1 commit into
Open
fix(postgrest): escape array-literal elements in cs/cd/contains/contained_by/overlaps#1593eeshsaxena wants to merge 1 commit into
eeshsaxena wants to merge 1 commit into
Conversation
…ined_by/overlaps
The array-membership filters built their PostgreSQL array literal {...} from
the raw str() of each element with no escaping, so an element containing the
comma delimiter (or a brace, double quote, backslash, whitespace, or the word
NULL, or an empty string) was emitted bare and mis-parsed by PostgREST. A
value with a comma silently split into extra elements: contains("tags",
["a,b", "c"]) sent cs.{a,b,c}, which PostgREST reads as three elements.
Add sanitize_array_param/sanitize_array_element that quote each element
following PostgreSQL array-literal rules, and use them from the five array
operators. in_() already quoted via sanitize_param; this brings the {...}
operators in line. Simple values are unchanged.
Fixes supabase#1592
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Bug fix.
Fixes #1592.
What is the current behavior?
cs,cd,contains,contained_by, andoverlapsbuild their PostgreSQL array literal{...}from the rawstr()of each element with no escaping. Any element containing the comma delimiter (or a brace, double quote, backslash, whitespace, or the wordNULL, or an empty string) is emitted bare and mis-parsed by PostgREST. The comma case is the clearest:in_()already quotes correctly viasanitize_param; the{...}operators did not. The suite even encoded the corruption:test_contained_by_mixed_itemsasserted{a,["b", "c"]}, itself a malformed literal whose inner comma splits the second element.What is the new behavior?
Added
sanitize_array_element/sanitize_array_paraminutils.pythat quote each element following PostgreSQL array-literal rules (quote when empty,NULL, or containing a brace / comma / double quote / backslash / whitespace; backslash-escape embedded quotes and backslashes), and routed the five array operators through it.Simple values are unchanged (
["a", "b"]->{a,b},[1, 2, 3]->{1,2,3}; plain-string and dict/JSON inputs untouched), so this is backward-compatible for the common case.test_contained_by_mixed_itemsis updated to the corrected literal, with a comment noting the old output was corrupted.Additional context
NULLcases acrosscs/cd/contains/contained_by/overlaps, in both the_asyncsource and the generated_syncmirror. Full postgrest unit suite,ruff, andmypypass locally.{...}array operators.in_()uses a different (parenthesized) syntax and its own quoting, left untouched.