search

aquametalabs / aquameta

Web development platform built entirely in PostgreSQL
GNU General Public License v3.0
1.1k stars 52 forks source link

bundle: search not escaping strings properly #156

Open erichanson opened 5 years ago

erichanson commented 5 years ago

Screwed up the escaping in search somehow. Breaks on single quotes. Revisit and use format() better.

syntax error at or near "done"
LINE 6: ... rrf.stage_row_id = sr.row_id  where value ilike '%'done'%' 
                                                               ^
QUERY:  select
        b.id as bundle_id, b.name, array_agg(c.id) as commit_id, array_agg(rrf.field_id::text) as field_ids, array_agg(c.message), rrf.value_hash, value
        from bundle.bundle b
            join bundle.commit c on c.bundle_id=b.id 
            join bundle.stage_row sr on sr.bundle_id = b.id
            join bundle.stage_row_field rrf on rrf.stage_row_id = sr.row_id  where value ilike '%'done'%' 
        group by b.id, b.name, rrf.value_hash, value
CONTEXT:  PL/pgSQL function bundle.search(text,bundle.search_method,bundle.search_scope,uuid) line 48 at RETURN QUERY
PL/pgSQL function anonymous_rows_select_function(text,text,json) line 42 at FOR over EXECUTE statement
PL/pgSQL function endpoint.request(text,text,text,json,json) line 152 at RETURN QUERY