forest_liana 9.22.12 → 9.22.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9584149ffb7d20be9b8f4dacd36f5bf1d95c5276b1b34f35d86e750e0f696f2
-  data.tar.gz: 2d24e798d72ec62aabec3ebe9fdb070f857c8e511b02d4bbe8e8ce1880e03032
+  metadata.gz: 0ea33256d7cec4221e9c94bbe46f8bc4f7caaef29854b237cff1961aed4809dd
+  data.tar.gz: c80925513502ae243fabd0d0c6840483634940882226ccb1e6c686c0cbc52553
 SHA512:
-  metadata.gz: 87d06d138209e8ca03019c971e0aa24e0c55bb8f71f03df225cf8de312f2fcb7dbac04cd398308c8a2768f7226b9c36e06ccdbed6d63225a5abe5a0bc26cc448
-  data.tar.gz: 31a54daccf9d158680b28d5747f35a467943f94a779448f812f43dfe8f84ba9cd921297dc930a958d7b6bd1660f8d3becd15abb50480db9c516d8b7a21e98508
+  metadata.gz: f21a026ae94a6061ba804462b9e681dc4e43fa57ace54b627ca06fcec199d1ddbeebdbc701c94e4820d3e00de8bab105dc6acd3614db4f855318592b6957ab81
+  data.tar.gz: 0f8579fab129cd9ba90747c9c37a22de38bf4aa0bf89a210e4cee5a806129a9aee1b1adb5da22c8ede9925047478cf18fbceb79b394f5d5323b27f13a2e1ce08

data/app/controllers/forest_liana/actions_controller.rb

@@ -47,6 +47,12 @@ module ForestLiana
       {:field_changed => found_field_changed, :fields => fields, :params => params, :user => forest_user}
     end
 
+    def ensure_single_record_selection(action, attributes)
+      return if SingleRecordSelection.allowed?(action, attributes)
+
+      raise ForestLiana::Errors::HTTP422Error.new(SingleRecordSelection::MESSAGE)
+    end
+
     def handle_result(result, action)
       if result.nil? || !result.is_a?(Array)
         return render status: 500, json: { error: 'Error in smart action load hook: hook must return an array of fields' }
@@ -104,6 +110,8 @@ module ForestLiana
       if !action
         render status: 500, json: {error: 'Error in smart action load hook: cannot retrieve action from collection'}
       else
+        ensure_single_record_selection(action, load_request)
+
         # Get the smart action hook load context
         context = get_smart_action_load_ctx(action.fields)
 
@@ -132,6 +140,8 @@ module ForestLiana
         return render status: 500, json: {error: 'Error in smart action change hook: fields params must be an array'}
       end
 
+      ensure_single_record_selection(action, change_request)
+
       # Get the smart action hook change context
       context = get_smart_action_change_ctx(change_request[:fields], change_request[:changed_field])
 

data/app/services/forest_liana/ability/permission.rb

@@ -35,6 +35,7 @@ module ForestLiana
       end
 
       def is_smart_action_authorized?(user, collection, parameters, endpoint, http_method)
+        ensure_single_record_selection(collection, parameters, endpoint, http_method)
         return true unless has_permission_system?
 
         user_data = get_user_data(user['id'])
@@ -348,6 +349,24 @@ module ForestLiana
         actions
       end
 
+      def ensure_single_record_selection(collection, parameters, endpoint, http_method)
+        schema_action = find_action_from_endpoint(ForestLiana.name_for(collection), endpoint, http_method)
+        return unless schema_action&.type == 'single'
+
+        selections = [parameters[:data][:attributes], signed_approval_attributes(parameters)].compact
+        return if selections.all? { |attributes| SingleRecordSelection.allowed?(schema_action, attributes) }
+
+        raise ForestLiana::Errors::HTTP422Error.new(SingleRecordSelection::MESSAGE)
+      end
+
+      def signed_approval_attributes(parameters)
+        return unless parameters[:data][:attributes][:signed_approval_request]
+
+        RequestPermission.decodeSignedApprovalRequest(parameters)[:data][:attributes]
+      rescue JWT::DecodeError
+        nil
+      end
+
       def find_action_from_endpoint(collection_name, endpoint, http_method)
         collection = ForestLiana.apimap.find { |collection| collection.name.to_s == collection_name }
 

data/app/services/forest_liana/query_stat_getter.rb

@@ -13,14 +13,11 @@ module ForestLiana
     end
 
     def perform
-      context_variables = Utils::ContextVariables.new(nil, nil, @params['contextVariables'])
-      raw_query = Utils::ContextVariablesInjector.inject_context_in_value(@params['query'].strip, context_variables)
-
-      LiveQueryChecker.new(raw_query, 'Live Query Chart').validate()
+      query = @params['query'].strip
+      LiveQueryChecker.new(query, 'Live Query Chart').validate()
 
-      if @params['record_id']
-        raw_query.gsub!('?', @params['record_id'].to_s)
-      end
+      context_variables = Utils::ContextVariables.new(nil, nil, @params['contextVariables'])
+      raw_query = Utils::LiveQueryInjector.inject(query, context_variables, @params['record_id'])
       result = ActiveRecord::Base.connection.execute(raw_query)
 
       case @params['type']

data/app/services/forest_liana/single_record_selection.rb

@@ -0,0 +1,11 @@
+module ForestLiana
+  module SingleRecordSelection
+    MESSAGE = 'This action can only be triggered on one record at a time.'
+
+    def self.allowed?(action, attributes)
+      return true unless action&.type == 'single'
+
+      !attributes[:all_records] && Array(attributes[:ids]).length == 1
+    end
+  end
+end

data/app/services/forest_liana/utils/context_variables_injector.rb

@@ -1,30 +1,33 @@
 module ForestLiana
   module Utils
     class ContextVariablesInjector
+      PLACEHOLDER = /{{([^}]+)}}/
 
       def self.inject_context_in_value(value, context_variables)
         inject_context_in_value_custom(value) do |context_variable_key|
-          value = context_variables.get_value(context_variable_key)
-          if value.nil?
-            available_keys = context_variables.respond_to?(:keys) ? context_variables.keys.join(', ') : 'unknown'
-            available_context = context_variables.inspect
-            error_message = "Unknown context variable: '#{context_variable_key}'. " \
-                          "Please check the query for any typos. " \
-                          "Available context variables: #{available_keys}. "
-            raise error_message
-          end
-          value.is_a?(Array) || value.is_a?(Hash) ? value.to_json : value.to_s
+          context_value(context_variable_key, context_variables)
         end
       end
 
+      def self.context_value(context_variable_key, context_variables)
+        value = context_variables.get_value(context_variable_key)
+        if value.nil?
+          available_keys = context_variables.respond_to?(:keys) ? context_variables.keys.join(', ') : 'unknown'
+          error_message = "Unknown context variable: '#{context_variable_key}'. " \
+                        "Please check the query for any typos. " \
+                        "Available context variables: #{available_keys}. "
+          raise error_message
+        end
+        value.is_a?(Array) || value.is_a?(Hash) ? value.to_json : value.to_s
+      end
+
       def self.inject_context_in_value_custom(value)
         return value unless value.is_a?(String)
 
         value_with_context_variables_injected = value
-        regex = /{{([^}]+)}}/
         encountered_variables = []
 
-        while (match = regex.match(value_with_context_variables_injected))
+        while (match = PLACEHOLDER.match(value_with_context_variables_injected))
           context_variable_key = match[1]
 
           value_with_context_variables_injected = value_with_context_variables_injected.gsub(

data/app/services/forest_liana/utils/live_query_injector.rb

@@ -0,0 +1,136 @@
+require 'strscan'
+
+module ForestLiana
+  module Utils
+    class LiveQueryInjector
+      PLACEHOLDER = Regexp.union(ContextVariablesInjector::PLACEHOLDER, '?')
+      VERBATIM_VALUE = /\A(?:\d+(?:\.\d+)?(?:,\d+(?:\.\d+)?)*|true|false)\z/i
+      CHARACTERS_CLOSING_QUOTED_TEXT = /["`'\\$\]\r\n\0]/
+      LINE_COMMENT = /--[^\n]*/
+      MYSQL_LINE_COMMENT = /--(?=[[:space:][:cntrl:]]|\z)[^\n]*/
+      BLOCK_COMMENT = %r{/\*.*?(?:\*/|\z)}m
+      NESTED_BLOCK_COMMENT = %r{(?<comment>/\*(?:[^/*]|/(?!\*)|\*(?!/)|\g<comment>)*(?:\*/|\z))}m
+      BRACKET_QUOTED = /\[[^\]]*\]?/
+      WORD = /[[:alpha:]_][[:alnum:]_$]*/
+      STRING_CONTINUATION = /[ \t\f\r]*\n[[:space:]]*(?=')/
+      DOLLAR_QUOTED = /\$([[:alpha:]_][[:alnum:]_]*|)\$.*?(?:\$\1\$|\z)/m
+
+      def self.inject(query, context_variables, record_id, connection = ActiveRecord::Base.connection)
+        new(context_variables, record_id, connection).inject(query)
+      end
+
+      def initialize(context_variables, record_id, connection)
+        @context_variables = context_variables
+        @record_id = record_id
+        @connection = connection
+        @mysql = connection.adapter_name.match?(/mysql|trilogy/i)
+        @postgresql = connection.adapter_name.match?(/postg/i)
+        @bracket_quotes = connection.adapter_name.match?(/sqlite|sqlserver/i)
+        @nested_comments = @postgresql || connection.adapter_name.match?(/sqlserver/i)
+        @backslash_escapes = @mysql && mysql_backslash_escapes?
+      end
+
+      def inject(query)
+        scanner = StringScanner.new(query)
+        injected = +''
+        injected << next_token(scanner) until scanner.eos?
+        injected
+      end
+
+      private
+
+      def next_token(scanner)
+        if (comment = scan_comment(scanner))
+          comment
+        elsif (word = scanner.scan(WORD))
+          return word unless @postgresql && word.casecmp?('e') && scanner.peek(1) == "'"
+
+          word + inject_in_string(scan_escape_string(scanner), backslash_escapes: true, escape_backslashes: true)
+        elsif (string = scanner.scan(quoted_pattern("'", backslash_escapes: @backslash_escapes)))
+          inject_in_string(string, backslash_escapes: @backslash_escapes, escape_backslashes: false)
+        elsif (quoted = scan_quoted_text(scanner))
+          inject_in_quoted_text(quoted)
+        elsif (placeholder = scanner.scan(PLACEHOLDER))
+          inject_in_code(placeholder)
+        else
+          scanner.getch
+        end
+      end
+
+      def mysql_backslash_escapes?
+        !@connection.select_value('SELECT @@SESSION.sql_mode').to_s.include?('NO_BACKSLASH_ESCAPES')
+      end
+
+      def scan_comment(scanner)
+        scanner.scan(@mysql ? MYSQL_LINE_COMMENT : LINE_COMMENT) ||
+          scanner.scan(@nested_comments ? NESTED_BLOCK_COMMENT : BLOCK_COMMENT) ||
+          (@mysql && scanner.scan(/#[^\n]*/))
+      end
+
+      def scan_escape_string(scanner)
+        escape_string = scanner.scan(quoted_pattern("'", backslash_escapes: true))
+        while (continuation = scanner.scan(STRING_CONTINUATION))
+          escape_string << continuation << scanner.scan(quoted_pattern("'", backslash_escapes: true))
+        end
+        escape_string
+      end
+
+      def scan_quoted_text(scanner)
+        scanner.scan(quoted_pattern('"', backslash_escapes: @backslash_escapes)) ||
+          scanner.scan(quoted_pattern('`')) ||
+          (@postgresql && scanner.scan(DOLLAR_QUOTED)) ||
+          (@bracket_quotes && scanner.scan(BRACKET_QUOTED))
+      end
+
+      def quoted_pattern(quote, backslash_escapes: false)
+        escaped = Regexp.escape(quote)
+        content = backslash_escapes ? "[^#{escaped}\\\\]|\\\\.|#{escaped}#{escaped}" : "[^#{escaped}]|#{escaped}#{escaped}"
+        /#{escaped}(?:#{content})*#{escaped}?/m
+      end
+
+      def inject_in_code(placeholder)
+        replace_placeholders(placeholder) do |text|
+          text.match?(VERBATIM_VALUE) ? text : @connection.quote(text)
+        end
+      end
+
+      def inject_in_string(string, backslash_escapes:, escape_backslashes:)
+        replace_placeholders(string) do |text, placeholder, preceding_text|
+          if backslash_escapes && preceding_text[/\\*\z/].length.odd?
+            raise ForestLiana::Errors::LiveQueryError.new(
+              "Live Query Chart: #{placeholder} cannot follow a backslash inside a string."
+            )
+          end
+          escape_backslashes ? text.gsub(/[\\']/) { |character| character * 2 } : @connection.quote_string(text)
+        end
+      end
+
+      def inject_in_quoted_text(quoted)
+        replace_placeholders(quoted) do |text, placeholder|
+          if text.match?(CHARACTERS_CLOSING_QUOTED_TEXT)
+            raise ForestLiana::Errors::LiveQueryError.new(
+              "Live Query Chart: The value of #{placeholder} cannot contain quotes, brackets, backslashes, " \
+              'dollar signs or line breaks when it is written inside a quoted identifier or a dollar-quoted string.'
+            )
+          end
+          text
+        end
+      end
+
+      def replace_placeholders(text)
+        text.gsub(PLACEHOLDER) do |placeholder|
+          context_variable_key = Regexp.last_match(1)
+          preceding_text = Regexp.last_match.pre_match
+          if context_variable_key
+            value = ContextVariablesInjector.context_value(context_variable_key, @context_variables)
+            yield(value, placeholder, preceding_text)
+          elsif @record_id.nil?
+            placeholder
+          else
+            yield(@record_id.to_s, placeholder, preceding_text)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.12"
+  VERSION = "9.22.14"
 end

data/spec/requests/actions_controller_spec.rb

@@ -217,6 +217,47 @@ describe 'Requesting Actions routes', :type => :request  do
       end
     end
 
+    describe 'on a single-record action' do
+      let(:single_record_error) { 'This action can only be triggered on one record at a time.' }
+
+      before do
+        action = island.actions.find { |action| action.name == 'my_action' }
+        allow(action).to receive(:type).and_return('single')
+      end
+
+      def hook_params(attributes)
+        JSON.dump(data: { attributes: { collection_name: 'Island' }.merge(attributes) })
+      end
+
+      [
+        ['two ids', { ids: [1, 2] }],
+        ['no id', { ids: [] }],
+        ['a select-all', { ids: [1], all_records: true }],
+      ].each do |description, selection|
+        it "should refuse to load the form given #{description}" do
+          post '/forest/actions/my_action/hooks/load', params: hook_params(selection), headers: headers
+
+          expect(response.status).to eq(422)
+          expect(response.body).to include(single_record_error)
+        end
+      end
+
+      it 'should refuse a change given two ids' do
+        post '/forest/actions/my_action/hooks/change',
+          params: hook_params(ids: [1, 2], fields: [{ field: 'foo', hook: 'on_foo_changed' }], changed_field: 'foo'),
+          headers: headers
+
+        expect(response.status).to eq(422)
+        expect(response.body).to include(single_record_error)
+      end
+
+      it 'should load the form on exactly one id' do
+        post '/forest/actions/my_action/hooks/load', params: hook_params(ids: [1]), headers: headers
+
+        expect(response.status).to eq(200)
+      end
+    end
+
     describe 'call /change' do
       it 'should respond 200' do
         action = island.actions.select { |action| action.name == 'my_action' }.first

data/spec/services/forest_liana/ability/permission_spec.rb

@@ -428,6 +428,80 @@ module ForestLiana
           expect {dummy_class.is_smart_action_authorized?(user, String, parameters, '/forest/actions/my_action', 'POST')}
             .to raise_error(ForestLiana::Ability::Exceptions::UnknownCollection, 'The collection String doesn\'t exist')
         end
+
+        it 'should run a bulk action on several ids' do
+          parameters[:data][:attributes][:ids] = ['1', '2']
+
+          expect(dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST')).to equal true
+        end
+
+        describe 'with a single-record action' do
+          let(:single_record_error) { 'This action can only be triggered on one record at a time.' }
+
+          before do
+            island_action = ForestLiana.apimap.find { |collection| collection.name.to_s == 'Island' }
+              .actions.find { |action| action.name == 'my_action' }
+            allow(island_action).to receive(:type).and_return('single')
+          end
+
+          it 'should return true on exactly one id' do
+            expect(dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST')).to equal true
+          end
+
+          [
+            ['two ids', { ids: ['1', '2'] }],
+            ['no id', { ids: [] }],
+            ['a select-all', { ids: ['1'], all_records: true }],
+          ].each do |description, selection|
+            it "should refuse #{description} before checking permissions" do
+              parameters[:data][:attributes].merge!(selection)
+              expect(SmartActionChecker).not_to receive(:new)
+
+              expect { dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST') }
+                .to raise_error(ForestLiana::Errors::HTTP422Error, single_record_error)
+            end
+          end
+
+          def sign(ids)
+            JWT.encode(
+              { data: { attributes: parameters[:data][:attributes].to_h.merge(ids: ids, requester_id: 2) } },
+              ForestLiana.env_secret,
+              'HS256'
+            )
+          end
+
+          it 'should refuse to approve a request naming several ids' do
+            parameters[:data][:attributes][:signed_approval_request] = sign(['1', '2'])
+            expect(SmartActionChecker).not_to receive(:new)
+
+            expect { dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST') }
+              .to raise_error(ForestLiana::Errors::HTTP422Error, single_record_error)
+          end
+
+          it 'should refuse several ids sent beside a signed request naming one' do
+            parameters[:data][:attributes][:ids] = ['1', '2']
+            parameters[:data][:attributes][:signed_approval_request] = sign(['1'])
+            expect(SmartActionChecker).not_to receive(:new)
+
+            expect { dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST') }
+              .to raise_error(ForestLiana::Errors::HTTP422Error, single_record_error)
+          end
+
+          it 'should leave an undecodable signed request to the permission check' do
+            parameters[:data][:attributes][:signed_approval_request] = 'not-a-jwt'
+            expect(Permission::SmartActionChecker).to receive(:new).and_return(instance_double(Permission::SmartActionChecker, can_execute?: true))
+
+            expect(dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST')).to equal true
+          end
+
+          it 'should refuse several ids without a permission system' do
+            Rails.cache.write('forest.has_permission', false)
+            parameters[:data][:attributes][:ids] = ['1', '2']
+
+            expect { dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST') }
+              .to raise_error(ForestLiana::Errors::HTTP422Error, single_record_error)
+          end
+        end
       end
 
       describe 'when the server doesn\'t return an success response' do

data/spec/services/forest_liana/query_stat_getter_spec.rb

@@ -0,0 +1,267 @@
+module ForestLiana
+  describe QueryStatGetter do
+    let!(:aragorn) { User.create!(name: 'Aragorn') }
+    let!(:obrien) { User.create!(name: "O'Brien") }
+    let!(:sam) { User.create!(name: 'Sam') }
+
+    def value_of(query, record_id: nil, context_variables: nil)
+      params = { 'type' => 'Value', 'query' => query }
+      params['record_id'] = record_id unless record_id.nil?
+      params['contextVariables'] = context_variables unless context_variables.nil?
+
+      getter = QueryStatGetter.new(params)
+      getter.perform
+      getter.record.value[:countCurrent]
+    end
+
+    describe 'record id' do
+      it 'matches the record whose integer id replaces ?' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: aragorn.id)).to eq(1)
+      end
+
+      it 'matches the record whose integer id is sent as a string' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: aragorn.id.to_s)).to eq(1)
+      end
+
+      it 'matches a string id written inside quotes in the query' do
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: 'Aragorn')).to eq(1)
+      end
+
+      it 'matches a string id that contains a quote' do
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: "O'Brien")).to eq(1)
+      end
+
+      it 'matches a string id written without quotes in the query' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE name = ?', record_id: 'Aragorn')).to eq(1)
+      end
+
+      it 'matches a UUID id written without quotes in the query' do
+        uuid = '3f2504e0-4f89-11d3-9a0c-0305e82c3301'
+        User.create!(name: uuid)
+
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE name = ?', record_id: uuid)).to eq(1)
+      end
+
+      it 'compares a non-numeric record id as a single value' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: '0 OR 1=1')).to eq(0)
+      end
+
+      it 'keeps a record id containing quotes inside its string literal' do
+        expect(
+          value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: "x' OR '1'='1")
+        ).to eq(0)
+      end
+
+      it 'compares a record id holding a semicolon as a single value' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: '1; DELETE FROM users')).to eq(0)
+        expect(User.count).to eq(3)
+      end
+
+      it 'matches a string id holding a semicolon' do
+        User.create!(name: 'a;b')
+
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: 'a;b')).to eq(1)
+      end
+
+      it 'refuses a query that chains statements before any value is injected' do
+        expect {
+          value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?; DELETE FROM users', record_id: 1)
+        }.to raise_error(ForestLiana::Errors::LiveQueryError, /You cannot chain SQL/)
+        expect(User.count).to eq(3)
+      end
+
+      it 'leaves ? untouched when no record id is sent' do
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name <> '?'")).to eq(3)
+      end
+    end
+
+    describe 'context variables' do
+      it 'matches the record whose integer id is injected' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: { 'users.selectedRecord.id' => aragorn.id.to_s }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches every id of a comma-separated list of integers' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id IN ({{users.selectedRecords.id}})',
+            context_variables: { 'users.selectedRecords.id' => "#{aragorn.id},#{sam.id}" }
+          )
+        ).to eq(2)
+      end
+
+      it 'matches a string written inside quotes in the query' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => 'Aragorn' }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string that contains a quote' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => "O'Brien" }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string written without quotes in the query' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE name = {{dropdown.selectedValue}}',
+            context_variables: { 'dropdown.selectedValue' => 'Aragorn' }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string injected in the middle of a string literal' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name LIKE '%{{search.value}}%'",
+            context_variables: { 'search.value' => 'rag' }
+          )
+        ).to eq(1)
+      end
+
+      it 'injects a boolean as a boolean' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE {{toggle.value}}',
+            context_variables: { 'toggle.value' => 'true' }
+          )
+        ).to eq(3)
+      end
+
+      it 'injects the same variable everywhere it appears' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}} OR name = '{{users.selectedRecord.id}}'",
+            context_variables: { 'users.selectedRecord.id' => sam.id.to_s }
+          )
+        ).to eq(1)
+      end
+
+      it 'compares a non-numeric value as a single value' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: { 'users.selectedRecord.id' => '0 OR 1=1' }
+          )
+        ).to eq(0)
+      end
+
+      it 'compares a value holding a second SELECT as a single value' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: { 'users.selectedRecord.id' => '0 UNION SELECT 99 ORDER BY 1 DESC' }
+          )
+        ).to eq(0)
+      end
+
+      it 'keeps a value containing quotes inside its string literal' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => "x' OR '1'='1" }
+          )
+        ).to eq(0)
+      end
+
+      it 'keeps a value containing quotes inside the string literal it is injected into' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name LIKE '%{{search.value}}%'",
+            context_variables: { 'search.value' => "%' OR '1'='1" }
+          )
+        ).to eq(0)
+      end
+
+      it 'leaves variables written in a comment untouched' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users -- {{note.value}}\nWHERE id = {{users.selectedRecord.id}}",
+            context_variables: { 'note.value' => "\nOR 1=1", 'users.selectedRecord.id' => aragorn.id.to_s }
+          )
+        ).to eq(1)
+      end
+
+      it 'injects a plain value inside a quoted identifier' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM "{{dropdown.selectedValue}}"',
+            context_variables: { 'dropdown.selectedValue' => 'users' }
+          )
+        ).to eq(3)
+      end
+
+      it 'refuses a value that would end the quoted identifier it is injected into' do
+        expect {
+          value_of(
+            'SELECT COUNT(*) AS value FROM "{{dropdown.selectedValue}}"',
+            context_variables: { 'dropdown.selectedValue' => 'users" WHERE 1=0 OR "1' }
+          )
+        }.to raise_error(ForestLiana::Errors::LiveQueryError)
+      end
+
+      it 'does not inject a variable or the record id found inside an injected value' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}' OR id = ?",
+            record_id: aragorn.id,
+            context_variables: { 'dropdown.selectedValue' => '{{other.value}}?' }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string holding a semicolon' do
+        User.create!(name: 'a;b')
+
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => 'a;b' }
+          )
+        ).to eq(1)
+      end
+
+      it 'compares a value holding a semicolon and a second statement as a single value' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE name = {{dropdown.selectedValue}}',
+            context_variables: { 'dropdown.selectedValue' => 'Sam; DELETE FROM users' }
+          )
+        ).to eq(0)
+        expect(User.count).to eq(3)
+      end
+
+      it 'raises on a variable the request does not provide' do
+        expect {
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: {}
+          )
+        }.to raise_error(/Unknown context variable: 'users\.selectedRecord\.id'/)
+      end
+    end
+
+    describe 'with both a record id and context variables' do
+      it 'injects both' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE id = ? OR name = '{{dropdown.selectedValue}}'",
+            record_id: aragorn.id,
+            context_variables: { 'dropdown.selectedValue' => 'Sam' }
+          )
+        ).to eq(2)
+      end
+    end
+  end
+end

data/spec/services/forest_liana/search_query_builder_spec.rb

@@ -751,6 +751,7 @@ module ForestLiana
 
       before do
         Rails.cache.write('forest.has_permission', false)
+        allow(ForestLiana::ScopeManager).to receive(:fetch_scopes).and_return({ 'scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' } })
         allow(ForestLiana::ScopeManager).to receive(:append_scope).and_call_original
         allow(ForestLiana::ScopeManager).to receive(:get_scope).and_return(nil)
       end

data/spec/services/forest_liana/utils/live_query_injector_spec.rb

@@ -0,0 +1,273 @@
+module ForestLiana
+  module Utils
+    describe LiveQueryInjector do
+      let(:context_variables) { ContextVariables.new(nil, nil, request_context_variables) }
+      let(:request_context_variables) { {} }
+
+      def mysql_connection(sql_mode: 'STRICT_TRANS_TABLES,NO_ENGINE_SUBSTITUTION')
+        connection = double('mysql connection', adapter_name: 'Mysql2')
+        allow(connection).to receive(:select_value).with('SELECT @@SESSION.sql_mode').and_return(sql_mode)
+        if sql_mode.include?('NO_BACKSLASH_ESCAPES')
+          allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+        else
+          allow(connection).to receive(:quote_string) { |value| value.gsub(/[\\'"]/) { |char| "\\#{char}" } }
+        end
+        allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+        connection
+      end
+
+      def sqlserver_connection
+        connection = double('sqlserver connection', adapter_name: 'SQLServer')
+        allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+        allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+        connection
+      end
+
+      def postgresql_connection
+        connection = double('postgresql connection', adapter_name: 'PostgreSQL')
+        allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+        allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+        connection
+      end
+
+      def inject(query, connection, record_id: nil)
+        LiveQueryInjector.inject(query, context_variables, record_id, connection)
+      end
+
+      describe 'on MySQL' do
+        let(:request_context_variables) { { 'x.value' => '0 OR 1=1' } }
+
+        it 'reads a backslash-escaped quote as part of the string literal' do
+          expect(inject("SELECT 1 FROM t WHERE a = 'it\\'s' AND id = {{x.value}}", mysql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = 'it\\'s' AND id = '0 OR 1=1'")
+        end
+
+        it 'escapes a value injected inside a string literal with the connection' do
+          request_context_variables['x.value'] = "a\\' OR 1=1 -- "
+
+          expect(inject("SELECT 1 FROM t WHERE a LIKE '%{{x.value}}%'", mysql_connection))
+            .to eq("SELECT 1 FROM t WHERE a LIKE '%a\\\\\\' OR 1=1 -- %'")
+        end
+
+        it 'injects a plain value inside a double-quoted string' do
+          request_context_variables['x.value'] = 'Aragorn'
+
+          expect(inject('SELECT 1 FROM t WHERE a = "{{x.value}}"', mysql_connection))
+            .to eq('SELECT 1 FROM t WHERE a = "Aragorn"')
+        end
+
+        it 'refuses a value holding a quote inside a double-quoted string' do
+          request_context_variables['x.value'] = 'a" OR "1'
+
+          expect { inject('SELECT 1 FROM t WHERE a = "{{x.value}}"', mysql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'refuses a value placed right after a backslash inside a string literal' do
+          request_context_variables['x.value'] = "' OR true -- "
+
+          expect { inject("SELECT 1 FROM t WHERE a = '\\{{x.value}}'", mysql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'refuses a record id placed right after a backslash inside a string literal' do
+          expect { inject("SELECT 1 FROM t WHERE a = '\\?'", mysql_connection, record_id: "' OR true -- ") }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'reads two dashes not followed by a space as code' do
+          request_context_variables['x.value'] = '5'
+
+          expect(inject('SELECT 1--{{x.value}} AS value FROM t', mysql_connection))
+            .to eq('SELECT 1--5 AS value FROM t')
+        end
+
+        it 'leaves a dash-dash-space comment untouched' do
+          expect(inject("SELECT 1 FROM t -- {{x.value}} ?\nWHERE id = ?", mysql_connection, record_id: 7))
+            .to eq("SELECT 1 FROM t -- {{x.value}} ?\nWHERE id = 7")
+        end
+
+        it 'ends a dash-dash comment at the line break right after it' do
+          expect(inject("SELECT 1 FROM t --\nWHERE id = ?", mysql_connection, record_id: 7))
+            .to eq("SELECT 1 FROM t --\nWHERE id = 7")
+        end
+
+        it 'injects a plain value inside a backtick-quoted identifier' do
+          request_context_variables['x.value'] = 'name'
+
+          expect(inject('SELECT `{{x.value}}` AS value FROM t', mysql_connection))
+            .to eq('SELECT `name` AS value FROM t')
+        end
+
+        it 'refuses a value holding a backtick inside a backtick-quoted identifier' do
+          request_context_variables['x.value'] = 'name` FROM t WHERE 1=0 OR `1'
+
+          expect { inject('SELECT `{{x.value}}` AS value FROM t', mysql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        describe 'when the session does not treat backslashes as escapes' do
+          let(:connection) { mysql_connection(sql_mode: 'STRICT_TRANS_TABLES,NO_BACKSLASH_ESCAPES') }
+
+          it 'reads a backslash as a plain character of a string literal' do
+            expect(inject("SELECT 1 FROM t WHERE a = 'x\\' AND id = {{x.value}}", connection))
+              .to eq("SELECT 1 FROM t WHERE a = 'x\\' AND id = '0 OR 1=1'")
+          end
+
+          it 'injects a value placed right after a backslash inside a string literal' do
+            request_context_variables['x.value'] = "a'b"
+
+            expect(inject("SELECT 1 FROM t WHERE a = '\\{{x.value}}'", connection))
+              .to eq("SELECT 1 FROM t WHERE a = '\\a''b'")
+          end
+        end
+
+        it 'leaves a hash comment untouched' do
+          expect(inject("SELECT 1 FROM t # {{x.value}} ?\nWHERE id = ?", mysql_connection, record_id: 7))
+            .to eq("SELECT 1 FROM t # {{x.value}} ?\nWHERE id = 7")
+        end
+      end
+
+      describe 'on PostgreSQL' do
+        let(:request_context_variables) { { 'x.value' => '0 OR 1=1' } }
+
+        it 'reads a backslash as a plain character of a standard string literal' do
+          expect(inject("SELECT 1 FROM t WHERE a = 'a\\' AND id = {{x.value}}", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = 'a\\' AND id = '0 OR 1=1'")
+        end
+
+        it 'escapes quotes and backslashes of a value injected inside an escape string' do
+          request_context_variables['x.value'] = "\\' OR 1=1 --"
+
+          expect(inject("SELECT 1 FROM t WHERE a = E'{{x.value}}'", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = E'\\\\'' OR 1=1 --'")
+        end
+
+        it 'leaves the hash operator outside comments' do
+          expect(inject('SELECT 1 # {{x.value}} AS value FROM t', postgresql_connection))
+            .to eq("SELECT 1 # '0 OR 1=1' AS value FROM t")
+        end
+
+        it 'refuses a value placed right after a backslash inside an escape string' do
+          request_context_variables['x.value'] = "' OR true -- "
+
+          expect { inject("SELECT 1 FROM t WHERE a = E'\\{{x.value}}'", postgresql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'refuses a value right after a backslash in the continuation of an escape string' do
+          request_context_variables['x.value'] = "' OR true -- "
+
+          expect { inject("SELECT 1 FROM t WHERE a = E'a'\n  '\\{{x.value}}'", postgresql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'escapes backslashes of a value injected in the continuation of an escape string' do
+          request_context_variables['x.value'] = "a\\b"
+
+          expect(inject("SELECT 1 FROM t WHERE a = E'a'\n'{{x.value}}'", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = E'a'\n'a\\\\b'")
+        end
+
+        it 'injects a value placed right after an escaped backslash inside an escape string' do
+          request_context_variables['x.value'] = "a'b"
+
+          expect(inject("SELECT 1 FROM t WHERE a = E'\\\\{{x.value}}'", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = E'\\\\a''b'")
+        end
+
+        it 'quotes a value placed after an untagged dollar-quoted string' do
+          expect(inject('SELECT $$a$$ AS value FROM t WHERE id = {{x.value}}', postgresql_connection))
+            .to eq("SELECT $$a$$ AS value FROM t WHERE id = '0 OR 1=1'")
+        end
+
+        it 'injects a plain value inside a dollar-quoted string' do
+          request_context_variables['x.value'] = 'Aragorn'
+
+          expect(inject('SELECT 1 FROM t WHERE a = $tag${{x.value}}$tag$', postgresql_connection))
+            .to eq('SELECT 1 FROM t WHERE a = $tag$Aragorn$tag$')
+        end
+
+        it 'refuses a value holding a dollar sign inside a dollar-quoted string' do
+          request_context_variables['x.value'] = '$tag$ OR 1=1 --'
+
+          expect { inject('SELECT 1 FROM t WHERE a = $tag${{x.value}}$tag$', postgresql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'leaves a nested block comment untouched' do
+          expect(inject('SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = {{x.value}}', postgresql_connection))
+            .to eq("SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = '0 OR 1=1'")
+        end
+
+        it 'leaves a block comment untouched' do
+          expect(inject('SELECT 1 /* {{x.value}} ? */ FROM t WHERE id = ?', postgresql_connection, record_id: 'abc'))
+            .to eq("SELECT 1 /* {{x.value}} ? */ FROM t WHERE id = 'abc'")
+        end
+      end
+
+      describe 'on SQLite' do
+        let(:request_context_variables) { { 'x.value' => 'users' } }
+
+        def sqlite_connection
+          connection = double('sqlite connection', adapter_name: 'SQLite')
+          allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+          allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+          connection
+        end
+
+        it 'injects a plain value inside a bracket-quoted identifier' do
+          expect(inject('SELECT COUNT(*) AS value FROM [{{x.value}}]', sqlite_connection))
+            .to eq('SELECT COUNT(*) AS value FROM [users]')
+        end
+
+        it 'refuses a value holding a closing bracket inside a bracket-quoted identifier' do
+          request_context_variables['x.value'] = 'users] WHERE 1=0 OR [1'
+
+          expect { inject('SELECT COUNT(*) AS value FROM [{{x.value}}]', sqlite_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'reads a nested block comment marker as plain comment text' do
+          request_context_variables['x.value'] = '0 OR 1=1'
+
+          expect(inject('SELECT 1 /* a /* b */ FROM t WHERE id = {{x.value}}', sqlite_connection))
+            .to eq("SELECT 1 /* a /* b */ FROM t WHERE id = '0 OR 1=1'")
+        end
+      end
+
+      describe 'on SQL Server' do
+        let(:request_context_variables) { { 'x.value' => '0 OR 1=1' } }
+
+        it 'leaves a nested block comment untouched' do
+          expect(inject('SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = {{x.value}}', sqlserver_connection))
+            .to eq("SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = '0 OR 1=1'")
+        end
+      end
+
+      it 'reads {{...}} with the grammar of the filter injector' do
+        expect(LiveQueryInjector::PLACEHOLDER.source).to include(ContextVariablesInjector::PLACEHOLDER.source)
+      end
+
+      describe 'value formats outside literals' do
+        let(:request_context_variables) do
+          {
+            'n.value' => '42',
+            'd.value' => '4.5',
+            'l.value' => '1,2,3',
+            'b.value' => 'FALSE',
+            'neg.value' => '-1',
+            's.value' => 'DESC'
+          }
+        end
+
+        it 'injects unsigned numbers, lists of numbers and booleans as they are, everything else as a string' do
+          query = 'SELECT {{n.value}}, {{d.value}}, ({{l.value}}), {{b.value}}, {{neg.value}}, {{s.value}}'
+
+          expect(inject(query, postgresql_connection))
+            .to eq("SELECT 42, 4.5, (1,2,3), FALSE, '-1', 'DESC'")
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.12
+  version: 9.22.14
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-13 00:00:00.000000000 Z
+date: 2026-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -332,6 +332,7 @@ files:
 - app/services/forest_liana/schema_utils.rb
 - app/services/forest_liana/scope_manager.rb
 - app/services/forest_liana/search_query_builder.rb
+- app/services/forest_liana/single_record_selection.rb
 - app/services/forest_liana/smart_action_field_validator.rb
 - app/services/forest_liana/smart_action_form_parser.rb
 - app/services/forest_liana/smart_field_dependencies.rb
@@ -350,6 +351,7 @@ files:
 - app/services/forest_liana/utils/beta_schema_utils.rb
 - app/services/forest_liana/utils/context_variables.rb
 - app/services/forest_liana/utils/context_variables_injector.rb
+- app/services/forest_liana/utils/live_query_injector.rb
 - app/services/forest_liana/value_stat_getter.rb
 - app/views/layouts/forest_liana/application.html.erb
 - config/initializers/error-messages.rb
@@ -521,6 +523,7 @@ files:
 - spec/services/forest_liana/line_stat_getter_spec.rb
 - spec/services/forest_liana/pie_stat_getter_spec.rb
 - spec/services/forest_liana/projection_parser_spec.rb
+- spec/services/forest_liana/query_stat_getter_spec.rb
 - spec/services/forest_liana/request_cache_spec.rb
 - spec/services/forest_liana/resource_updater_spec.rb
 - spec/services/forest_liana/resources_getter_composite_keys_spec.rb
@@ -536,6 +539,7 @@ files:
 - spec/services/forest_liana/smart_field_dependencies_spec.rb
 - spec/services/forest_liana/utils/context_variables_injector_spec.rb
 - spec/services/forest_liana/utils/context_variables_spec.rb
+- spec/services/forest_liana/utils/live_query_injector_spec.rb
 - spec/services/forest_liana/value_stat_getter_spec.rb
 - spec/spec_helper.rb
 - spec/support/forest_liana/query_capture.rb
@@ -883,6 +887,7 @@ test_files:
 - spec/services/forest_liana/line_stat_getter_spec.rb
 - spec/services/forest_liana/pie_stat_getter_spec.rb
 - spec/services/forest_liana/projection_parser_spec.rb
+- spec/services/forest_liana/query_stat_getter_spec.rb
 - spec/services/forest_liana/request_cache_spec.rb
 - spec/services/forest_liana/resource_updater_spec.rb
 - spec/services/forest_liana/resources_getter_composite_keys_spec.rb
@@ -898,6 +903,7 @@ test_files:
 - spec/services/forest_liana/smart_field_dependencies_spec.rb
 - spec/services/forest_liana/utils/context_variables_injector_spec.rb
 - spec/services/forest_liana/utils/context_variables_spec.rb
+- spec/services/forest_liana/utils/live_query_injector_spec.rb
 - spec/services/forest_liana/value_stat_getter_spec.rb
 - spec/spec_helper.rb
 - spec/support/forest_liana/query_capture.rb