@prisma-next/emitter 0.3.0-dev.147 → 0.3.0-dev.149

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma-next/emitter",
-  "version": "0.3.0-dev.147",
+  "version": "0.3.0-dev.149",
   "type": "module",
   "sideEffects": false,
   "files": [
@@ -11,18 +11,18 @@
   "dependencies": {
     "arktype": "^2.0.0",
     "prettier": "^3.3.3",
-    "@prisma-next/framework-components": "0.3.0-dev.147",
-    "@prisma-next/utils": "0.3.0-dev.147",
-    "@prisma-next/operations": "0.3.0-dev.147",
-    "@prisma-next/contract": "0.3.0-dev.147"
+    "@prisma-next/framework-components": "0.3.0-dev.149",
+    "@prisma-next/utils": "0.3.0-dev.149",
+    "@prisma-next/contract": "0.3.0-dev.149",
+    "@prisma-next/operations": "0.3.0-dev.149"
   },
   "devDependencies": {
     "@types/node": "24.10.4",
     "tsdown": "0.18.4",
     "typescript": "5.9.3",
     "vitest": "4.0.17",
-    "@prisma-next/test-utils": "0.0.1",
     "@prisma-next/tsconfig": "0.0.0",
+    "@prisma-next/test-utils": "0.0.1",
     "@prisma-next/tsdown": "0.0.0"
   },
   "exports": {

package/test/domain-type-generation.test.ts

@@ -74,6 +74,40 @@ describe('serializeValue', () => {
   it('returns unknown for unsupported types', () => {
     expect(serializeValue(Symbol('test'))).toBe('unknown');
   });
+
+  describe('injection safety', () => {
+    // Lock the escape behavior so attacker-controlled (or merely weird) strings
+    // in a schema.prisma cannot break out of the emitted single-quoted literal
+    // and inject arbitrary TypeScript into contract.d.ts.
+
+    it('escapes a string attempting to terminate the literal', () => {
+      const injected = "x'; export let foo = 'bar";
+      const serialized = serializeValue(injected);
+      expect(serialized).toBe("'x\\'; export let foo = \\'bar'");
+      // The serialized form is a single valid string literal: exactly two
+      // outer single quotes, and every inner single quote is backslash-escaped.
+      expect(serialized.match(/(?<!\\)'/g)?.length).toBe(2);
+    });
+
+    it('escapes backslash-terminated strings (no lookahead break-out)', () => {
+      expect(serializeValue('ends with \\')).toBe("'ends with \\\\'");
+      expect(serializeValue('double\\\\back')).toBe("'double\\\\\\\\back'");
+    });
+
+    it('passes through control characters and line separators as raw bytes', () => {
+      // U+2028/U+2029 are JavaScript line terminators in legacy parsers.
+      // The current emitter does not escape them but they cannot break the
+      // single-quoted literal since they are not \' or \\. Pin the behavior.
+      expect(serializeValue('a\u2028b')).toBe("'a\u2028b'");
+      expect(serializeValue('a\u2029b')).toBe("'a\u2029b'");
+      expect(serializeValue('a\nb')).toBe("'a\nb'");
+    });
+
+    it('quotes object keys that look like identifier bypass attempts', () => {
+      expect(serializeObjectKey("k'; injected: 'v")).toBe("'k\\'; injected: \\'v'");
+      expect(serializeObjectKey('')).toBe("''");
+    });
+  });
 });
 
 describe('serializeObjectKey', () => {