Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Refuse to build unsafe JSON lists for contains in Postgres #5337

Merged
merged 1 commit into from
Jan 31, 2019
Merged

Refuse to build unsafe JSON lists for contains in Postgres #5337

merged 1 commit into from
Jan 31, 2019

Conversation

mrclay
Copy link
Contributor

@mrclay mrclay commented Jan 31, 2019 •
edited
Loading

Postgres doesn't seem to have a safe way to escape or parameterize arbitrary strings within these expressions.

@codecov
Copy link

codecov bot commented Jan 31, 2019 •
edited
Loading

Codecov Report

Merging #5337 into master will increase coverage by <.01%.
The diff coverage is 50%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #5337      +/-   ##
==========================================
+ Coverage   93.88%   93.88%   +<.01%     
==========================================
  Files         123      123              
  Lines        8972     8974       +2     
==========================================
+ Hits         8423     8425       +2     
  Misses        549      549
Impacted Files Coverage Δ
...dapters/Storage/Postgres/PostgresStorageAdapter.js 96.99% <50%> (-0.17%) ⬇️
src/RestWrite.js 93.24% <0%> (+0.36%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7e48b7a...89fecb7. Read the comment docs.

@mrclay mrclay changed the title Safer escaping of strings in JSON arrays Refuse to build unsafe JSON lists for contains in Postgres Jan 31, 2019
flovilmart
flovilmart approved these changes Jan 31, 2019
View reviewed changes
Copy link
Contributor

@flovilmart flovilmart left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice

@dplewis
Copy link
Member

dplewis commented Jan 31, 2019 •
edited
Loading

@mrclay I think instead of throwing an error we should remove es6 templated strings in favor of the pg-promise formatting engine.

@flovilmart flovilmart merged commit 038d7bd into parse-community:master Jan 31, 2019
@mrclay mrclay deleted the escape-json branch February 6, 2019 22:12
@vitaly-t
Copy link
Contributor

vitaly-t commented Mar 3, 2019

I think instead of throwing an error we should remove es6 templated strings in favor of the pg-promise formatting engine.

That would be the right fix indeed 😉

UnderratedDev pushed a commit to UnderratedDev/parse-server that referenced this pull request Mar 21, 2020
@mrclay @flovilmart
postgres: Refuse to build unsafe JSON lists for contains in Postgres (p…
9b95ae9 
…arse-community#5337)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@flovilmart flovilmart flovilmart approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@mrclay @dplewis @vitaly-t @flovilmart