bun-query-builder 0.2.41 → 0.2.43

package/dist/bin/cli.js

@@ -12856,7 +12856,10 @@ function warnOnceBareSqlFragment(context) {
   if (warnedSqlFragmentContexts.has(context))
     return;
   warnedSqlFragmentContexts.add(context);
-  console.warn(`[query-builder] ${context}: bare string passed to a *Raw method. ` + `Prefer \`sql\`...\`\` tagged-template fragments so values are parameterised ` + `instead of concatenated \u2014 concatenating request input into SQL is an ` + `injection vector. This will become a hard error in a future release.`);
+  console.warn(`[query-builder] ${context}: bare string passed to a *Raw method. ` + `Prefer the \`raw\`...\`\` tagged template, which escapes interpolated ` + `values for the configured dialect \u2014 concatenating request input into SQL ` + `is an injection vector. This will become a hard error in a future release.`);
+}
+function escapeStringLiteral(value, dialect = config5.dialect) {
+  return isMysqlLike(dialect) ? value.replace(/\\/g, "\\\\").replace(/'/g, "''") : value.replace(/'/g, "''");
 }
 function formatSubqueryValue(val) {
   if (val === null)
@@ -12866,7 +12869,7 @@ function formatSubqueryValue(val) {
   if (typeof val === "boolean")
     return val ? "1" : "0";
   if (typeof val === "string")
-    return `'${val.replace(/'/g, "''")}'`;
+    return `'${escapeStringLiteral(val)}'`;
   if (val instanceof Date)
     return `'${val.toISOString()}'`;
   throw new TypeError(`[query-builder] subquery condition: refusing to interpolate value of type ${typeof val}`);
@@ -14487,11 +14490,13 @@ function createQueryBuilder(state) {
         const dialect = config5.dialect;
         const idx = whereParams.length + 1;
         if (dialect === "postgres") {
+          const needsJsonbLift = typeof json === "number" || typeof json === "boolean";
+          const operand = needsJsonbLift ? `to_jsonb(${getPlaceholder(idx)})` : getPlaceholder(idx);
           if (config5.sql?.jsonContainsMode === "function")
-            pushWhere("AND", `jsonb_contains(${column}, ${getPlaceholder(idx)})`);
+            pushWhere("AND", `jsonb_contains(${column}, ${operand})`);
           else
-            pushWhere("AND", `${column} @> ${getPlaceholder(idx)}`);
-          whereParams.push(JSON.stringify(json));
+            pushWhere("AND", `${column} @> ${operand}`);
+          whereParams.push(json);
         } else if (isMysqlLike(dialect)) {
           pushWhere("AND", `JSON_CONTAINS(${column}, ${getPlaceholder(idx)})`);
           whereParams.push(JSON.stringify(json));
@@ -32354,7 +32359,7 @@ function getPrefix() {
 }
 var prefix = getPrefix();
 // package.json
-var version2 = "0.2.41";
+var version2 = "0.2.43";
 
 // bin/cli.ts
 init_actions();

package/dist/client.d.ts

@@ -2,7 +2,7 @@ import { config } from './config';
 import { resetConnection } from './db';
 import type { DatabaseSchema } from './schema';
 import type { DriverConnection } from './db';
-import type { QueryHooks } from './types';
+import type { QueryHooks, SupportedDialect } from './types';
 import type { SchemaMeta } from './meta';
 /**
  * # `raw`
@@ -31,6 +31,24 @@ import type { SchemaMeta } from './meta';
  * ```
  */
 export declare function raw(strings: TemplateStringsArray | string, ...values: unknown[]): RawExpression;
+/**
+ * Format a value for safe interpolation into a relationship-subquery
+ * fragment. Numbers / booleans / null pass through; everything else is
+ * rejected.
+ *
+ * **Strings are escaped for the configured dialect, not just for ANSI.**
+ * Doubling the single quote is correct on Postgres and SQLite and is not
+ * sufficient on the MySQL family, where a backslash is itself an escape
+ * character unless NO_BACKSLASH_ESCAPES is set. Doubling alone lets
+ * `x\'; DROP TABLE t; --` through: it becomes `'x\''; DROP TABLE t; --'`,
+ * MySQL reads `\'` as a literal quote inside the string, the next quote closes
+ * it, and the remainder executes as its own statement.
+ *
+ * So on a MySQL-like dialect the backslash is doubled first. Order matters:
+ * escaping quotes first and backslashes second would re-escape the backslash
+ * this function had just introduced.
+ */
+export declare function escapeStringLiteral(value: string, dialect?: SupportedDialect): string;
 // eslint-disable-next-line pickier/no-unused-vars
 export declare function createQueryBuilder<DB extends DatabaseSchema<any>>(state?: Partial<InternalState>): QueryBuilder<DB>;
 /**

package/dist/src/index.js

@@ -12855,7 +12855,10 @@ function warnOnceBareSqlFragment(context) {
   if (warnedSqlFragmentContexts.has(context))
     return;
   warnedSqlFragmentContexts.add(context);
-  console.warn(`[query-builder] ${context}: bare string passed to a *Raw method. ` + `Prefer \`sql\`...\`\` tagged-template fragments so values are parameterised ` + `instead of concatenated \u2014 concatenating request input into SQL is an ` + `injection vector. This will become a hard error in a future release.`);
+  console.warn(`[query-builder] ${context}: bare string passed to a *Raw method. ` + `Prefer the \`raw\`...\`\` tagged template, which escapes interpolated ` + `values for the configured dialect \u2014 concatenating request input into SQL ` + `is an injection vector. This will become a hard error in a future release.`);
+}
+function escapeStringLiteral(value, dialect = config5.dialect) {
+  return isMysqlLike(dialect) ? value.replace(/\\/g, "\\\\").replace(/'/g, "''") : value.replace(/'/g, "''");
 }
 function formatSubqueryValue(val) {
   if (val === null)
@@ -12865,7 +12868,7 @@ function formatSubqueryValue(val) {
   if (typeof val === "boolean")
     return val ? "1" : "0";
   if (typeof val === "string")
-    return `'${val.replace(/'/g, "''")}'`;
+    return `'${escapeStringLiteral(val)}'`;
   if (val instanceof Date)
     return `'${val.toISOString()}'`;
   throw new TypeError(`[query-builder] subquery condition: refusing to interpolate value of type ${typeof val}`);
@@ -14486,11 +14489,13 @@ function createQueryBuilder(state) {
         const dialect = config5.dialect;
         const idx = whereParams.length + 1;
         if (dialect === "postgres") {
+          const needsJsonbLift = typeof json === "number" || typeof json === "boolean";
+          const operand = needsJsonbLift ? `to_jsonb(${getPlaceholder(idx)})` : getPlaceholder(idx);
           if (config5.sql?.jsonContainsMode === "function")
-            pushWhere("AND", `jsonb_contains(${column}, ${getPlaceholder(idx)})`);
+            pushWhere("AND", `jsonb_contains(${column}, ${operand})`);
           else
-            pushWhere("AND", `${column} @> ${getPlaceholder(idx)}`);
-          whereParams.push(JSON.stringify(json));
+            pushWhere("AND", `${column} @> ${operand}`);
+          whereParams.push(json);
         } else if (isMysqlLike(dialect)) {
           pushWhere("AND", `JSON_CONTAINS(${column}, ${getPlaceholder(idx)})`);
           whereParams.push(JSON.stringify(json));
@@ -30380,6 +30385,7 @@ export {
   queryExplainAll as explainAllQueries,
   explain,
   executeMigration,
+  escapeStringLiteral,
   dynamo,
   dumpDatabase,
   defineSeeder,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bun-query-builder",
   "type": "module",
-  "version": "0.2.41",
+  "version": "0.2.43",
   "description": "A simple yet performant query builder for TypeScript. Built with Bun.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",