Skip to content

Commit aa84e0a

Browse files
committed
Prevent escaping on custom condition
1 parent b3352c9 commit aa84e0a

1 file changed

Lines changed: 14 additions & 8 deletions

File tree

src/index.js

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,18 @@ export const dbTypes = [
7272

7373
const sanitize = identifier => identifier.replace(/([^A-Za-z0-9_]+)/g, '');
7474

75+
const getCondition = (conditionMapper, column, condition) => {
76+
let currCondition = conditionMap[condition];
77+
if (conditionMapper) {
78+
const mappedCondition = conditionMapper(column, condition, currCondition);
79+
if (mappedCondition) {
80+
currCondition = mappedCondition;
81+
}
82+
}
83+
84+
return currCondition;
85+
};
86+
7587
export const defaultPreprocessor = () => filterKey => `"${sanitize(filterKey)}"`;
7688

7789
export const jsonbPreprocessor = jsonbColumn => filterKey => `${sanitize(jsonbColumn)}->>'${sanitize(filterKey)}'`;
@@ -105,13 +117,7 @@ const processFilter = (filterQS, castFn, preprocessor, conditionMapper) => {
105117
if (cast) query = `(${preprocessed})::${cast}`;
106118
}
107119

108-
let currCondition = conditionMap[condition];
109-
if (conditionMapper) {
110-
const mappedCondition = conditionMapper(column, condition, currCondition);
111-
if (mappedCondition) {
112-
currCondition = mappedCondition;
113-
}
114-
}
120+
let currCondition = getCondition(conditionMapper, column, condition);
115121
if (currCondition.includes('??')) {
116122
return currCondition.replace('??', query);
117123
}
@@ -139,7 +145,7 @@ export const knexFlexFilter = (originalQuery, where = {}, opts = {}) => {
139145
let value = where[key];
140146

141147
// Escape apostrophes correctly
142-
const matchEscape = conditionMap[condition].match(/'(.*)\?(.*)'/);
148+
const matchEscape = getCondition(conditionMapper, column, condition).match(/'(.*)\?(.*)'/);
143149
if (matchEscape) {
144150
// eslint-disable-next-line no-unused-vars
145151
const [_, pre, post] = matchEscape;

0 commit comments

Comments
 (0)