@mikro-orm/sql 7.2.6-dev.31 → 7.2.6-dev.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/sql",
-  "version": "7.2.6-dev.31",
+  "version": "7.2.6-dev.33",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",
@@ -53,7 +53,7 @@
     "@mikro-orm/core": "^7.2.5"
   },
   "peerDependencies": {
-    "@mikro-orm/core": "7.2.6-dev.31"
+    "@mikro-orm/core": "7.2.6-dev.33"
   },
   "engines": {
     "node": ">= 22.17.0"

package/query/NativeQueryBuilder.d.ts

@@ -121,6 +121,8 @@ export declare class NativeQueryBuilder implements Subquery {
     lockMode(lockMode: LockMode, lockTables?: string[]): this;
     comment(comment: string | string[]): this;
     hintComment(comment: string | string[]): this;
+    /** Comments are interpolated verbatim, so a terminator or a `?` placeholder inside one would corrupt the query. */
+    private validateComments;
     setFlags(flags: Set<QueryFlag>): this;
     clear(clause: keyof Options): this;
     wrap(prefix: string, suffix: string): this;

package/query/NativeQueryBuilder.js

@@ -258,14 +258,23 @@ export class NativeQueryBuilder {
     }
     comment(comment) {
         this.options.comment ??= [];
-        this.options.comment.push(...Utils.asArray(comment));
+        this.options.comment.push(...this.validateComments(comment));
         return this;
     }
     hintComment(comment) {
         this.options.hintComment ??= [];
-        this.options.hintComment.push(...Utils.asArray(comment));
+        this.options.hintComment.push(...this.validateComments(comment));
         return this;
     }
+    /** Comments are interpolated verbatim, so a terminator or a `?` placeholder inside one would corrupt the query. */
+    validateComments(comment) {
+        const comments = Utils.asArray(comment);
+        const invalid = comments.find(c => c.includes('/*') || c.includes('*/') || c.includes('?'));
+        if (invalid != null) {
+            throw new Error(`Query comments cannot contain '/*', '*/' or '?', got: '${invalid}'`);
+        }
+        return comments;
+    }
     setFlags(flags) {
         this.options.flags = flags;
         return this;