forest_liana 9.22.13 → 9.22.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fcbf97d59c4b454c53e5f068f969e8e503e2a722c1a011e2d03b7f9e73a0c152
-  data.tar.gz: cd6608d3c224d6daaedd240928a34cec77d49c35bfdf52fdb0d5b5187a23cf02
+  metadata.gz: 0ea33256d7cec4221e9c94bbe46f8bc4f7caaef29854b237cff1961aed4809dd
+  data.tar.gz: c80925513502ae243fabd0d0c6840483634940882226ccb1e6c686c0cbc52553
 SHA512:
-  metadata.gz: 78dd9047c6f8647076342d0a99f223ad66c7c33590b6b8be4726901d4aa6b057eb97eb4137cd6de3852fcf06d505621b77e6d6b653bb699443e753b57955a782
-  data.tar.gz: c0dc2372c158fb2f86929279b3594ae6aec5b2270ae6fd74a19871c7dc26af89b0b20d8d5f8a822ddd6147ab11d89413f80df582168ea31e41e7fac847c2e430
+  metadata.gz: f21a026ae94a6061ba804462b9e681dc4e43fa57ace54b627ca06fcec199d1ddbeebdbc701c94e4820d3e00de8bab105dc6acd3614db4f855318592b6957ab81
+  data.tar.gz: 0f8579fab129cd9ba90747c9c37a22de38bf4aa0bf89a210e4cee5a806129a9aee1b1adb5da22c8ede9925047478cf18fbceb79b394f5d5323b27f13a2e1ce08

data/app/services/forest_liana/query_stat_getter.rb

@@ -13,14 +13,11 @@ module ForestLiana
     end
 
     def perform
-      context_variables = Utils::ContextVariables.new(nil, nil, @params['contextVariables'])
-      raw_query = Utils::ContextVariablesInjector.inject_context_in_value(@params['query'].strip, context_variables)
-
-      LiveQueryChecker.new(raw_query, 'Live Query Chart').validate()
+      query = @params['query'].strip
+      LiveQueryChecker.new(query, 'Live Query Chart').validate()
 
-      if @params['record_id']
-        raw_query.gsub!('?', @params['record_id'].to_s)
-      end
+      context_variables = Utils::ContextVariables.new(nil, nil, @params['contextVariables'])
+      raw_query = Utils::LiveQueryInjector.inject(query, context_variables, @params['record_id'])
       result = ActiveRecord::Base.connection.execute(raw_query)
 
       case @params['type']

data/app/services/forest_liana/utils/context_variables_injector.rb

@@ -1,30 +1,33 @@
 module ForestLiana
   module Utils
     class ContextVariablesInjector
+      PLACEHOLDER = /{{([^}]+)}}/
 
       def self.inject_context_in_value(value, context_variables)
         inject_context_in_value_custom(value) do |context_variable_key|
-          value = context_variables.get_value(context_variable_key)
-          if value.nil?
-            available_keys = context_variables.respond_to?(:keys) ? context_variables.keys.join(', ') : 'unknown'
-            available_context = context_variables.inspect
-            error_message = "Unknown context variable: '#{context_variable_key}'. " \
-                          "Please check the query for any typos. " \
-                          "Available context variables: #{available_keys}. "
-            raise error_message
-          end
-          value.is_a?(Array) || value.is_a?(Hash) ? value.to_json : value.to_s
+          context_value(context_variable_key, context_variables)
         end
       end
 
+      def self.context_value(context_variable_key, context_variables)
+        value = context_variables.get_value(context_variable_key)
+        if value.nil?
+          available_keys = context_variables.respond_to?(:keys) ? context_variables.keys.join(', ') : 'unknown'
+          error_message = "Unknown context variable: '#{context_variable_key}'. " \
+                        "Please check the query for any typos. " \
+                        "Available context variables: #{available_keys}. "
+          raise error_message
+        end
+        value.is_a?(Array) || value.is_a?(Hash) ? value.to_json : value.to_s
+      end
+
       def self.inject_context_in_value_custom(value)
         return value unless value.is_a?(String)
 
         value_with_context_variables_injected = value
-        regex = /{{([^}]+)}}/
         encountered_variables = []
 
-        while (match = regex.match(value_with_context_variables_injected))
+        while (match = PLACEHOLDER.match(value_with_context_variables_injected))
           context_variable_key = match[1]
 
           value_with_context_variables_injected = value_with_context_variables_injected.gsub(

data/app/services/forest_liana/utils/live_query_injector.rb

@@ -0,0 +1,136 @@
+require 'strscan'
+
+module ForestLiana
+  module Utils
+    class LiveQueryInjector
+      PLACEHOLDER = Regexp.union(ContextVariablesInjector::PLACEHOLDER, '?')
+      VERBATIM_VALUE = /\A(?:\d+(?:\.\d+)?(?:,\d+(?:\.\d+)?)*|true|false)\z/i
+      CHARACTERS_CLOSING_QUOTED_TEXT = /["`'\\$\]\r\n\0]/
+      LINE_COMMENT = /--[^\n]*/
+      MYSQL_LINE_COMMENT = /--(?=[[:space:][:cntrl:]]|\z)[^\n]*/
+      BLOCK_COMMENT = %r{/\*.*?(?:\*/|\z)}m
+      NESTED_BLOCK_COMMENT = %r{(?<comment>/\*(?:[^/*]|/(?!\*)|\*(?!/)|\g<comment>)*(?:\*/|\z))}m
+      BRACKET_QUOTED = /\[[^\]]*\]?/
+      WORD = /[[:alpha:]_][[:alnum:]_$]*/
+      STRING_CONTINUATION = /[ \t\f\r]*\n[[:space:]]*(?=')/
+      DOLLAR_QUOTED = /\$([[:alpha:]_][[:alnum:]_]*|)\$.*?(?:\$\1\$|\z)/m
+
+      def self.inject(query, context_variables, record_id, connection = ActiveRecord::Base.connection)
+        new(context_variables, record_id, connection).inject(query)
+      end
+
+      def initialize(context_variables, record_id, connection)
+        @context_variables = context_variables
+        @record_id = record_id
+        @connection = connection
+        @mysql = connection.adapter_name.match?(/mysql|trilogy/i)
+        @postgresql = connection.adapter_name.match?(/postg/i)
+        @bracket_quotes = connection.adapter_name.match?(/sqlite|sqlserver/i)
+        @nested_comments = @postgresql || connection.adapter_name.match?(/sqlserver/i)
+        @backslash_escapes = @mysql && mysql_backslash_escapes?
+      end
+
+      def inject(query)
+        scanner = StringScanner.new(query)
+        injected = +''
+        injected << next_token(scanner) until scanner.eos?
+        injected
+      end
+
+      private
+
+      def next_token(scanner)
+        if (comment = scan_comment(scanner))
+          comment
+        elsif (word = scanner.scan(WORD))
+          return word unless @postgresql && word.casecmp?('e') && scanner.peek(1) == "'"
+
+          word + inject_in_string(scan_escape_string(scanner), backslash_escapes: true, escape_backslashes: true)
+        elsif (string = scanner.scan(quoted_pattern("'", backslash_escapes: @backslash_escapes)))
+          inject_in_string(string, backslash_escapes: @backslash_escapes, escape_backslashes: false)
+        elsif (quoted = scan_quoted_text(scanner))
+          inject_in_quoted_text(quoted)
+        elsif (placeholder = scanner.scan(PLACEHOLDER))
+          inject_in_code(placeholder)
+        else
+          scanner.getch
+        end
+      end
+
+      def mysql_backslash_escapes?
+        !@connection.select_value('SELECT @@SESSION.sql_mode').to_s.include?('NO_BACKSLASH_ESCAPES')
+      end
+
+      def scan_comment(scanner)
+        scanner.scan(@mysql ? MYSQL_LINE_COMMENT : LINE_COMMENT) ||
+          scanner.scan(@nested_comments ? NESTED_BLOCK_COMMENT : BLOCK_COMMENT) ||
+          (@mysql && scanner.scan(/#[^\n]*/))
+      end
+
+      def scan_escape_string(scanner)
+        escape_string = scanner.scan(quoted_pattern("'", backslash_escapes: true))
+        while (continuation = scanner.scan(STRING_CONTINUATION))
+          escape_string << continuation << scanner.scan(quoted_pattern("'", backslash_escapes: true))
+        end
+        escape_string
+      end
+
+      def scan_quoted_text(scanner)
+        scanner.scan(quoted_pattern('"', backslash_escapes: @backslash_escapes)) ||
+          scanner.scan(quoted_pattern('`')) ||
+          (@postgresql && scanner.scan(DOLLAR_QUOTED)) ||
+          (@bracket_quotes && scanner.scan(BRACKET_QUOTED))
+      end
+
+      def quoted_pattern(quote, backslash_escapes: false)
+        escaped = Regexp.escape(quote)
+        content = backslash_escapes ? "[^#{escaped}\\\\]|\\\\.|#{escaped}#{escaped}" : "[^#{escaped}]|#{escaped}#{escaped}"
+        /#{escaped}(?:#{content})*#{escaped}?/m
+      end
+
+      def inject_in_code(placeholder)
+        replace_placeholders(placeholder) do |text|
+          text.match?(VERBATIM_VALUE) ? text : @connection.quote(text)
+        end
+      end
+
+      def inject_in_string(string, backslash_escapes:, escape_backslashes:)
+        replace_placeholders(string) do |text, placeholder, preceding_text|
+          if backslash_escapes && preceding_text[/\\*\z/].length.odd?
+            raise ForestLiana::Errors::LiveQueryError.new(
+              "Live Query Chart: #{placeholder} cannot follow a backslash inside a string."
+            )
+          end
+          escape_backslashes ? text.gsub(/[\\']/) { |character| character * 2 } : @connection.quote_string(text)
+        end
+      end
+
+      def inject_in_quoted_text(quoted)
+        replace_placeholders(quoted) do |text, placeholder|
+          if text.match?(CHARACTERS_CLOSING_QUOTED_TEXT)
+            raise ForestLiana::Errors::LiveQueryError.new(
+              "Live Query Chart: The value of #{placeholder} cannot contain quotes, brackets, backslashes, " \
+              'dollar signs or line breaks when it is written inside a quoted identifier or a dollar-quoted string.'
+            )
+          end
+          text
+        end
+      end
+
+      def replace_placeholders(text)
+        text.gsub(PLACEHOLDER) do |placeholder|
+          context_variable_key = Regexp.last_match(1)
+          preceding_text = Regexp.last_match.pre_match
+          if context_variable_key
+            value = ContextVariablesInjector.context_value(context_variable_key, @context_variables)
+            yield(value, placeholder, preceding_text)
+          elsif @record_id.nil?
+            placeholder
+          else
+            yield(@record_id.to_s, placeholder, preceding_text)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.13"
+  VERSION = "9.22.14"
 end

data/spec/services/forest_liana/query_stat_getter_spec.rb

@@ -0,0 +1,267 @@
+module ForestLiana
+  describe QueryStatGetter do
+    let!(:aragorn) { User.create!(name: 'Aragorn') }
+    let!(:obrien) { User.create!(name: "O'Brien") }
+    let!(:sam) { User.create!(name: 'Sam') }
+
+    def value_of(query, record_id: nil, context_variables: nil)
+      params = { 'type' => 'Value', 'query' => query }
+      params['record_id'] = record_id unless record_id.nil?
+      params['contextVariables'] = context_variables unless context_variables.nil?
+
+      getter = QueryStatGetter.new(params)
+      getter.perform
+      getter.record.value[:countCurrent]
+    end
+
+    describe 'record id' do
+      it 'matches the record whose integer id replaces ?' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: aragorn.id)).to eq(1)
+      end
+
+      it 'matches the record whose integer id is sent as a string' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: aragorn.id.to_s)).to eq(1)
+      end
+
+      it 'matches a string id written inside quotes in the query' do
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: 'Aragorn')).to eq(1)
+      end
+
+      it 'matches a string id that contains a quote' do
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: "O'Brien")).to eq(1)
+      end
+
+      it 'matches a string id written without quotes in the query' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE name = ?', record_id: 'Aragorn')).to eq(1)
+      end
+
+      it 'matches a UUID id written without quotes in the query' do
+        uuid = '3f2504e0-4f89-11d3-9a0c-0305e82c3301'
+        User.create!(name: uuid)
+
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE name = ?', record_id: uuid)).to eq(1)
+      end
+
+      it 'compares a non-numeric record id as a single value' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: '0 OR 1=1')).to eq(0)
+      end
+
+      it 'keeps a record id containing quotes inside its string literal' do
+        expect(
+          value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: "x' OR '1'='1")
+        ).to eq(0)
+      end
+
+      it 'compares a record id holding a semicolon as a single value' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: '1; DELETE FROM users')).to eq(0)
+        expect(User.count).to eq(3)
+      end
+
+      it 'matches a string id holding a semicolon' do
+        User.create!(name: 'a;b')
+
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: 'a;b')).to eq(1)
+      end
+
+      it 'refuses a query that chains statements before any value is injected' do
+        expect {
+          value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?; DELETE FROM users', record_id: 1)
+        }.to raise_error(ForestLiana::Errors::LiveQueryError, /You cannot chain SQL/)
+        expect(User.count).to eq(3)
+      end
+
+      it 'leaves ? untouched when no record id is sent' do
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name <> '?'")).to eq(3)
+      end
+    end
+
+    describe 'context variables' do
+      it 'matches the record whose integer id is injected' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: { 'users.selectedRecord.id' => aragorn.id.to_s }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches every id of a comma-separated list of integers' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id IN ({{users.selectedRecords.id}})',
+            context_variables: { 'users.selectedRecords.id' => "#{aragorn.id},#{sam.id}" }
+          )
+        ).to eq(2)
+      end
+
+      it 'matches a string written inside quotes in the query' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => 'Aragorn' }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string that contains a quote' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => "O'Brien" }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string written without quotes in the query' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE name = {{dropdown.selectedValue}}',
+            context_variables: { 'dropdown.selectedValue' => 'Aragorn' }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string injected in the middle of a string literal' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name LIKE '%{{search.value}}%'",
+            context_variables: { 'search.value' => 'rag' }
+          )
+        ).to eq(1)
+      end
+
+      it 'injects a boolean as a boolean' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE {{toggle.value}}',
+            context_variables: { 'toggle.value' => 'true' }
+          )
+        ).to eq(3)
+      end
+
+      it 'injects the same variable everywhere it appears' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}} OR name = '{{users.selectedRecord.id}}'",
+            context_variables: { 'users.selectedRecord.id' => sam.id.to_s }
+          )
+        ).to eq(1)
+      end
+
+      it 'compares a non-numeric value as a single value' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: { 'users.selectedRecord.id' => '0 OR 1=1' }
+          )
+        ).to eq(0)
+      end
+
+      it 'compares a value holding a second SELECT as a single value' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: { 'users.selectedRecord.id' => '0 UNION SELECT 99 ORDER BY 1 DESC' }
+          )
+        ).to eq(0)
+      end
+
+      it 'keeps a value containing quotes inside its string literal' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => "x' OR '1'='1" }
+          )
+        ).to eq(0)
+      end
+
+      it 'keeps a value containing quotes inside the string literal it is injected into' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name LIKE '%{{search.value}}%'",
+            context_variables: { 'search.value' => "%' OR '1'='1" }
+          )
+        ).to eq(0)
+      end
+
+      it 'leaves variables written in a comment untouched' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users -- {{note.value}}\nWHERE id = {{users.selectedRecord.id}}",
+            context_variables: { 'note.value' => "\nOR 1=1", 'users.selectedRecord.id' => aragorn.id.to_s }
+          )
+        ).to eq(1)
+      end
+
+      it 'injects a plain value inside a quoted identifier' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM "{{dropdown.selectedValue}}"',
+            context_variables: { 'dropdown.selectedValue' => 'users' }
+          )
+        ).to eq(3)
+      end
+
+      it 'refuses a value that would end the quoted identifier it is injected into' do
+        expect {
+          value_of(
+            'SELECT COUNT(*) AS value FROM "{{dropdown.selectedValue}}"',
+            context_variables: { 'dropdown.selectedValue' => 'users" WHERE 1=0 OR "1' }
+          )
+        }.to raise_error(ForestLiana::Errors::LiveQueryError)
+      end
+
+      it 'does not inject a variable or the record id found inside an injected value' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}' OR id = ?",
+            record_id: aragorn.id,
+            context_variables: { 'dropdown.selectedValue' => '{{other.value}}?' }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string holding a semicolon' do
+        User.create!(name: 'a;b')
+
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => 'a;b' }
+          )
+        ).to eq(1)
+      end
+
+      it 'compares a value holding a semicolon and a second statement as a single value' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE name = {{dropdown.selectedValue}}',
+            context_variables: { 'dropdown.selectedValue' => 'Sam; DELETE FROM users' }
+          )
+        ).to eq(0)
+        expect(User.count).to eq(3)
+      end
+
+      it 'raises on a variable the request does not provide' do
+        expect {
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: {}
+          )
+        }.to raise_error(/Unknown context variable: 'users\.selectedRecord\.id'/)
+      end
+    end
+
+    describe 'with both a record id and context variables' do
+      it 'injects both' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE id = ? OR name = '{{dropdown.selectedValue}}'",
+            record_id: aragorn.id,
+            context_variables: { 'dropdown.selectedValue' => 'Sam' }
+          )
+        ).to eq(2)
+      end
+    end
+  end
+end

data/spec/services/forest_liana/utils/live_query_injector_spec.rb

@@ -0,0 +1,273 @@
+module ForestLiana
+  module Utils
+    describe LiveQueryInjector do
+      let(:context_variables) { ContextVariables.new(nil, nil, request_context_variables) }
+      let(:request_context_variables) { {} }
+
+      def mysql_connection(sql_mode: 'STRICT_TRANS_TABLES,NO_ENGINE_SUBSTITUTION')
+        connection = double('mysql connection', adapter_name: 'Mysql2')
+        allow(connection).to receive(:select_value).with('SELECT @@SESSION.sql_mode').and_return(sql_mode)
+        if sql_mode.include?('NO_BACKSLASH_ESCAPES')
+          allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+        else
+          allow(connection).to receive(:quote_string) { |value| value.gsub(/[\\'"]/) { |char| "\\#{char}" } }
+        end
+        allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+        connection
+      end
+
+      def sqlserver_connection
+        connection = double('sqlserver connection', adapter_name: 'SQLServer')
+        allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+        allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+        connection
+      end
+
+      def postgresql_connection
+        connection = double('postgresql connection', adapter_name: 'PostgreSQL')
+        allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+        allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+        connection
+      end
+
+      def inject(query, connection, record_id: nil)
+        LiveQueryInjector.inject(query, context_variables, record_id, connection)
+      end
+
+      describe 'on MySQL' do
+        let(:request_context_variables) { { 'x.value' => '0 OR 1=1' } }
+
+        it 'reads a backslash-escaped quote as part of the string literal' do
+          expect(inject("SELECT 1 FROM t WHERE a = 'it\\'s' AND id = {{x.value}}", mysql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = 'it\\'s' AND id = '0 OR 1=1'")
+        end
+
+        it 'escapes a value injected inside a string literal with the connection' do
+          request_context_variables['x.value'] = "a\\' OR 1=1 -- "
+
+          expect(inject("SELECT 1 FROM t WHERE a LIKE '%{{x.value}}%'", mysql_connection))
+            .to eq("SELECT 1 FROM t WHERE a LIKE '%a\\\\\\' OR 1=1 -- %'")
+        end
+
+        it 'injects a plain value inside a double-quoted string' do
+          request_context_variables['x.value'] = 'Aragorn'
+
+          expect(inject('SELECT 1 FROM t WHERE a = "{{x.value}}"', mysql_connection))
+            .to eq('SELECT 1 FROM t WHERE a = "Aragorn"')
+        end
+
+        it 'refuses a value holding a quote inside a double-quoted string' do
+          request_context_variables['x.value'] = 'a" OR "1'
+
+          expect { inject('SELECT 1 FROM t WHERE a = "{{x.value}}"', mysql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'refuses a value placed right after a backslash inside a string literal' do
+          request_context_variables['x.value'] = "' OR true -- "
+
+          expect { inject("SELECT 1 FROM t WHERE a = '\\{{x.value}}'", mysql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'refuses a record id placed right after a backslash inside a string literal' do
+          expect { inject("SELECT 1 FROM t WHERE a = '\\?'", mysql_connection, record_id: "' OR true -- ") }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'reads two dashes not followed by a space as code' do
+          request_context_variables['x.value'] = '5'
+
+          expect(inject('SELECT 1--{{x.value}} AS value FROM t', mysql_connection))
+            .to eq('SELECT 1--5 AS value FROM t')
+        end
+
+        it 'leaves a dash-dash-space comment untouched' do
+          expect(inject("SELECT 1 FROM t -- {{x.value}} ?\nWHERE id = ?", mysql_connection, record_id: 7))
+            .to eq("SELECT 1 FROM t -- {{x.value}} ?\nWHERE id = 7")
+        end
+
+        it 'ends a dash-dash comment at the line break right after it' do
+          expect(inject("SELECT 1 FROM t --\nWHERE id = ?", mysql_connection, record_id: 7))
+            .to eq("SELECT 1 FROM t --\nWHERE id = 7")
+        end
+
+        it 'injects a plain value inside a backtick-quoted identifier' do
+          request_context_variables['x.value'] = 'name'
+
+          expect(inject('SELECT `{{x.value}}` AS value FROM t', mysql_connection))
+            .to eq('SELECT `name` AS value FROM t')
+        end
+
+        it 'refuses a value holding a backtick inside a backtick-quoted identifier' do
+          request_context_variables['x.value'] = 'name` FROM t WHERE 1=0 OR `1'
+
+          expect { inject('SELECT `{{x.value}}` AS value FROM t', mysql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        describe 'when the session does not treat backslashes as escapes' do
+          let(:connection) { mysql_connection(sql_mode: 'STRICT_TRANS_TABLES,NO_BACKSLASH_ESCAPES') }
+
+          it 'reads a backslash as a plain character of a string literal' do
+            expect(inject("SELECT 1 FROM t WHERE a = 'x\\' AND id = {{x.value}}", connection))
+              .to eq("SELECT 1 FROM t WHERE a = 'x\\' AND id = '0 OR 1=1'")
+          end
+
+          it 'injects a value placed right after a backslash inside a string literal' do
+            request_context_variables['x.value'] = "a'b"
+
+            expect(inject("SELECT 1 FROM t WHERE a = '\\{{x.value}}'", connection))
+              .to eq("SELECT 1 FROM t WHERE a = '\\a''b'")
+          end
+        end
+
+        it 'leaves a hash comment untouched' do
+          expect(inject("SELECT 1 FROM t # {{x.value}} ?\nWHERE id = ?", mysql_connection, record_id: 7))
+            .to eq("SELECT 1 FROM t # {{x.value}} ?\nWHERE id = 7")
+        end
+      end
+
+      describe 'on PostgreSQL' do
+        let(:request_context_variables) { { 'x.value' => '0 OR 1=1' } }
+
+        it 'reads a backslash as a plain character of a standard string literal' do
+          expect(inject("SELECT 1 FROM t WHERE a = 'a\\' AND id = {{x.value}}", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = 'a\\' AND id = '0 OR 1=1'")
+        end
+
+        it 'escapes quotes and backslashes of a value injected inside an escape string' do
+          request_context_variables['x.value'] = "\\' OR 1=1 --"
+
+          expect(inject("SELECT 1 FROM t WHERE a = E'{{x.value}}'", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = E'\\\\'' OR 1=1 --'")
+        end
+
+        it 'leaves the hash operator outside comments' do
+          expect(inject('SELECT 1 # {{x.value}} AS value FROM t', postgresql_connection))
+            .to eq("SELECT 1 # '0 OR 1=1' AS value FROM t")
+        end
+
+        it 'refuses a value placed right after a backslash inside an escape string' do
+          request_context_variables['x.value'] = "' OR true -- "
+
+          expect { inject("SELECT 1 FROM t WHERE a = E'\\{{x.value}}'", postgresql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'refuses a value right after a backslash in the continuation of an escape string' do
+          request_context_variables['x.value'] = "' OR true -- "
+
+          expect { inject("SELECT 1 FROM t WHERE a = E'a'\n  '\\{{x.value}}'", postgresql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'escapes backslashes of a value injected in the continuation of an escape string' do
+          request_context_variables['x.value'] = "a\\b"
+
+          expect(inject("SELECT 1 FROM t WHERE a = E'a'\n'{{x.value}}'", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = E'a'\n'a\\\\b'")
+        end
+
+        it 'injects a value placed right after an escaped backslash inside an escape string' do
+          request_context_variables['x.value'] = "a'b"
+
+          expect(inject("SELECT 1 FROM t WHERE a = E'\\\\{{x.value}}'", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = E'\\\\a''b'")
+        end
+
+        it 'quotes a value placed after an untagged dollar-quoted string' do
+          expect(inject('SELECT $$a$$ AS value FROM t WHERE id = {{x.value}}', postgresql_connection))
+            .to eq("SELECT $$a$$ AS value FROM t WHERE id = '0 OR 1=1'")
+        end
+
+        it 'injects a plain value inside a dollar-quoted string' do
+          request_context_variables['x.value'] = 'Aragorn'
+
+          expect(inject('SELECT 1 FROM t WHERE a = $tag${{x.value}}$tag$', postgresql_connection))
+            .to eq('SELECT 1 FROM t WHERE a = $tag$Aragorn$tag$')
+        end
+
+        it 'refuses a value holding a dollar sign inside a dollar-quoted string' do
+          request_context_variables['x.value'] = '$tag$ OR 1=1 --'
+
+          expect { inject('SELECT 1 FROM t WHERE a = $tag${{x.value}}$tag$', postgresql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'leaves a nested block comment untouched' do
+          expect(inject('SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = {{x.value}}', postgresql_connection))
+            .to eq("SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = '0 OR 1=1'")
+        end
+
+        it 'leaves a block comment untouched' do
+          expect(inject('SELECT 1 /* {{x.value}} ? */ FROM t WHERE id = ?', postgresql_connection, record_id: 'abc'))
+            .to eq("SELECT 1 /* {{x.value}} ? */ FROM t WHERE id = 'abc'")
+        end
+      end
+
+      describe 'on SQLite' do
+        let(:request_context_variables) { { 'x.value' => 'users' } }
+
+        def sqlite_connection
+          connection = double('sqlite connection', adapter_name: 'SQLite')
+          allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+          allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+          connection
+        end
+
+        it 'injects a plain value inside a bracket-quoted identifier' do
+          expect(inject('SELECT COUNT(*) AS value FROM [{{x.value}}]', sqlite_connection))
+            .to eq('SELECT COUNT(*) AS value FROM [users]')
+        end
+
+        it 'refuses a value holding a closing bracket inside a bracket-quoted identifier' do
+          request_context_variables['x.value'] = 'users] WHERE 1=0 OR [1'
+
+          expect { inject('SELECT COUNT(*) AS value FROM [{{x.value}}]', sqlite_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'reads a nested block comment marker as plain comment text' do
+          request_context_variables['x.value'] = '0 OR 1=1'
+
+          expect(inject('SELECT 1 /* a /* b */ FROM t WHERE id = {{x.value}}', sqlite_connection))
+            .to eq("SELECT 1 /* a /* b */ FROM t WHERE id = '0 OR 1=1'")
+        end
+      end
+
+      describe 'on SQL Server' do
+        let(:request_context_variables) { { 'x.value' => '0 OR 1=1' } }
+
+        it 'leaves a nested block comment untouched' do
+          expect(inject('SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = {{x.value}}', sqlserver_connection))
+            .to eq("SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = '0 OR 1=1'")
+        end
+      end
+
+      it 'reads {{...}} with the grammar of the filter injector' do
+        expect(LiveQueryInjector::PLACEHOLDER.source).to include(ContextVariablesInjector::PLACEHOLDER.source)
+      end
+
+      describe 'value formats outside literals' do
+        let(:request_context_variables) do
+          {
+            'n.value' => '42',
+            'd.value' => '4.5',
+            'l.value' => '1,2,3',
+            'b.value' => 'FALSE',
+            'neg.value' => '-1',
+            's.value' => 'DESC'
+          }
+        end
+
+        it 'injects unsigned numbers, lists of numbers and booleans as they are, everything else as a string' do
+          query = 'SELECT {{n.value}}, {{d.value}}, ({{l.value}}), {{b.value}}, {{neg.value}}, {{s.value}}'
+
+          expect(inject(query, postgresql_connection))
+            .to eq("SELECT 42, 4.5, (1,2,3), FALSE, '-1', 'DESC'")
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.13
+  version: 9.22.14
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-23 00:00:00.000000000 Z
+date: 2026-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -351,6 +351,7 @@ files:
 - app/services/forest_liana/utils/beta_schema_utils.rb
 - app/services/forest_liana/utils/context_variables.rb
 - app/services/forest_liana/utils/context_variables_injector.rb
+- app/services/forest_liana/utils/live_query_injector.rb
 - app/services/forest_liana/value_stat_getter.rb
 - app/views/layouts/forest_liana/application.html.erb
 - config/initializers/error-messages.rb
@@ -522,6 +523,7 @@ files:
 - spec/services/forest_liana/line_stat_getter_spec.rb
 - spec/services/forest_liana/pie_stat_getter_spec.rb
 - spec/services/forest_liana/projection_parser_spec.rb
+- spec/services/forest_liana/query_stat_getter_spec.rb
 - spec/services/forest_liana/request_cache_spec.rb
 - spec/services/forest_liana/resource_updater_spec.rb
 - spec/services/forest_liana/resources_getter_composite_keys_spec.rb
@@ -537,6 +539,7 @@ files:
 - spec/services/forest_liana/smart_field_dependencies_spec.rb
 - spec/services/forest_liana/utils/context_variables_injector_spec.rb
 - spec/services/forest_liana/utils/context_variables_spec.rb
+- spec/services/forest_liana/utils/live_query_injector_spec.rb
 - spec/services/forest_liana/value_stat_getter_spec.rb
 - spec/spec_helper.rb
 - spec/support/forest_liana/query_capture.rb
@@ -884,6 +887,7 @@ test_files:
 - spec/services/forest_liana/line_stat_getter_spec.rb
 - spec/services/forest_liana/pie_stat_getter_spec.rb
 - spec/services/forest_liana/projection_parser_spec.rb
+- spec/services/forest_liana/query_stat_getter_spec.rb
 - spec/services/forest_liana/request_cache_spec.rb
 - spec/services/forest_liana/resource_updater_spec.rb
 - spec/services/forest_liana/resources_getter_composite_keys_spec.rb
@@ -899,6 +903,7 @@ test_files:
 - spec/services/forest_liana/smart_field_dependencies_spec.rb
 - spec/services/forest_liana/utils/context_variables_injector_spec.rb
 - spec/services/forest_liana/utils/context_variables_spec.rb
+- spec/services/forest_liana/utils/live_query_injector_spec.rb
 - spec/services/forest_liana/value_stat_getter_spec.rb
 - spec/spec_helper.rb
 - spec/support/forest_liana/query_capture.rb