Skip to content

chore: use literal for limits and offsets#1075

Merged
staaldraad merged 1 commit intomasterfrom
etienne/sec-822
May 4, 2026
Merged

chore: use literal for limits and offsets#1075
staaldraad merged 1 commit intomasterfrom
etienne/sec-822

Conversation

@staaldraad
Copy link
Copy Markdown
Member

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

Limits and offsets are typed as Number but are treated as string in SQL template generation

What is the new behavior?

Treats these as literals so the SQL will always be correct / valid.

Additional context

Add any other context or screenshots.

@staaldraad staaldraad requested review from a team, avallete and soedirgo as code owners May 4, 2026 12:33
@staaldraad staaldraad changed the title Etienne/sec 822 chore: use literal for limits and offsets May 4, 2026
Copy link
Copy Markdown
Member

@avallete avallete left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do the escaping for filterByValue and filterByList even tough at the end of the day postgres-meta is meant to execute queries on database that the user already has access to.

Since the pattern is so similar everywhere, we might consider normalizing this into an helper. That can be done as a follow-up tough.

@staaldraad
Copy link
Copy Markdown
Member Author

We do the escaping for filterByValue and filterByList even tough at the end of the day postgres-meta is meant to execute queries on database that the user already has access to.Since the pattern is so similar everywhere, we might consider normalizing this into an helper. That can be done as a follow-up tough.

postgres-meta is meant to execute queries on database that the user already has access to

💯 agree, there are some endpoints though that have unexpected side effects, for example config.sql.ts can be called as:

http://127.0.0.1/config?limit=1%3BCREATE%20TABLE....

Pipeline-ing the create table... statement with the config read operation. This just tightens things up a little bit

@staaldraad staaldraad merged commit 03df514 into master May 4, 2026
6 checks passed
@staaldraad staaldraad deleted the etienne/sec-822 branch May 4, 2026 14:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants