aerotoad / neboa

Type-safe NoSQL with Node & SQLite. 🌫️💽
https://aerotoad.github.io/neboa/
GNU Affero General Public License v3.0
170 stars 1 forks source link

Neboa doesn't escape single quotes #7

Closed significantotter closed 1 year ago

significantotter commented 1 year ago

Describe the bug On attempting to insert a collection item with a single quote in it, neboa crashes

To Reproduce

import { neboa } from 'neboa';
import { z } from 'zod';

const db = neboa('testDb.db');

const fooType = z.object({ foo: z.string() });
const Foo = db.collection<z.infer<typeof fooType>>('foo');
await Foo.insert({ foo: "Didn't insert!" });

Expected behavior Neboa escapes special characters on insert. Use bound parameters instead of template literals for the database queries. For example:

/**
 * Inserts a new document into the collection
 * @param document Document to insert
 * @returns The inserted document
 */
function insert(document: T): NeboaDocument<T> {
    try {
        const newDocument = this.newDocument(document);
        this._database
            .prepare(
                `
                    INSERT INTO ${this._name} (id, data)
                    VALUES (?, ?);
                `
            )
            .bind([newDocument._id, JSON.stringify(newDocument)])
            .run();
        this._emitter.emit("create", [newDocument]);
        return newDocument;
    } catch (error) {
        throw error;
    }
}
aerotoad commented 1 year ago

Thanks @significantotter I totally missed this. Just replicated the issue and your solution. Added some test cases for escaping characters and will merge a solution asap.

significantotter commented 1 year ago

No problem! I was really glad to find this library. Zod + Embedded db + Nosql was my entire wishlist for a library for my current project. Despite this small hurdle (which I was able to get past with a quick JSON.parse( JSON.stringify( data ).replaceAll( "'" , "''" )) , I'm really enjoying this library so far!

aerotoad commented 1 year ago

@significantotter Should be good to go, version 0.6.1 should address this issue and allow you to use escaped characters while inserting/updating documents. Feel free to open another issue if you find any trouble 😄 .

Thanks!