cozy-pouch-link 60.36.1 → 60.36.2

package/dist/db/sqlite/sql.js

@@ -535,7 +535,7 @@ var makeSQLQueryFromMango = function makeSQLQueryFromMango(_ref3) {
   // queries the winning rev). `data` aliases 'by-sequence'.json; `deleted` lives
   // only on by-sequence, so the where clause stays unambiguous.
 
-  var sql = ["SELECT 'by-sequence'.json AS data, 'by-sequence'.doc_id, 'by-sequence'.rev", "FROM 'by-sequence' INDEXED BY ".concat(indexName, ", 'document-store'"), "WHERE 'by-sequence'.seq = 'document-store'.winningseq AND ".concat(whereClause)].join(' ');
+  var sql = ["SELECT 'by-sequence'.json AS data, 'by-sequence'.doc_id, 'by-sequence'.rev", "FROM 'by-sequence' INDEXED BY '".concat(escapeSQLString(indexName), "', 'document-store'"), "WHERE 'by-sequence'.seq = 'document-store'.winningseq AND ".concat(whereClause)].join(' ');
 
   if (sortClause) {
     sql += " ORDER BY ".concat(sortClause);
@@ -597,7 +597,7 @@ var makeSQLQueryAll = function makeSQLQueryAll() {
 exports.makeSQLQueryAll = makeSQLQueryAll;
 
 var makeSQLDropIndex = function makeSQLDropIndex(indexName) {
-  return "DROP INDEX IF EXISTS '".concat(indexName, "';");
+  return "DROP INDEX IF EXISTS '".concat(escapeSQLString(indexName), "';");
 };
 
 exports.makeSQLDropIndex = makeSQLDropIndex;
@@ -606,15 +606,16 @@ var makeSQLCreateMangoIndex = function makeSQLCreateMangoIndex(indexName, fields
   var partialFilter = _ref5.partialFilter;
   // Escaped like the where clause's paths, so an index covers exactly the
   // expression makeWhereClause emits for the same field.
-  // XXX - indexName itself is still interpolated raw here, in makeSQLDropIndex
-  // and in makeSQLQueryFromMango's INDEXED BY. The three must agree, so they are
-  // left alone together: a field name containing a quote would break index
-  // resolution rather than the where clause.
+  // The index name is quoted and escaped here, in makeSQLDropIndex and in
+  // makeSQLQueryFromMango's INDEXED BY. The three must agree: a partial filter
+  // puts its own values in the name, so it can hold parentheses and a dollar,
+  // which SQLite refuses to parse as a bare identifier, and a quote, which
+  // would end the quoted one.
   var jsonAttributes = fieldsToIndex.map(function (field) {
     return "json_extract(json, '$.".concat(escapeSQLString(field), "')");
   });
   var jsonIndex = jsonAttributes.join(',');
-  var sql = "\n    CREATE INDEX IF NOT EXISTS '".concat(indexName, "'\n    ON 'by-sequence'\n    (").concat(jsonIndex, ")\n  ");
+  var sql = "\n    CREATE INDEX IF NOT EXISTS '".concat(escapeSQLString(indexName), "'\n    ON 'by-sequence'\n    (").concat(jsonIndex, ")\n  ");
 
   if (partialFilter) {
     // `data` only exists as a SELECT alias of 'by-sequence'.json; inside CREATE

package/dist/db/sqlite/sql.spec.js

@@ -9,6 +9,7 @@ import {
   makeSQLQueryAll,
   parseResults,
   makeSQLCreateMangoIndex,
+  makeSQLDropIndex,
   toWebSQLResult
 } from './sql'
 
@@ -159,7 +160,7 @@ describe('makeSQLQueryFromMango', () => {
 
     const expectedSql = [
       `SELECT 'by-sequence'.json AS data, 'by-sequence'.doc_id, 'by-sequence'.rev`,
-      `FROM 'by-sequence' INDEXED BY by_name, 'document-store'`,
+      `FROM 'by-sequence' INDEXED BY 'by_name', 'document-store'`,
       `WHERE 'by-sequence'.seq = 'document-store'.winningseq AND DELETED = 0 AND (json_extract(data, '$.date') > '2025-01-01')`,
       `LIMIT 100;`
     ].join(' ')
@@ -175,7 +176,7 @@ describe('makeSQLQueryFromMango', () => {
 
     const expectedSql = [
       `SELECT 'by-sequence'.json AS data, 'by-sequence'.doc_id, 'by-sequence'.rev`,
-      `FROM 'by-sequence' INDEXED BY by_name, 'document-store'`,
+      `FROM 'by-sequence' INDEXED BY 'by_name', 'document-store'`,
       `WHERE 'by-sequence'.seq = 'document-store'.winningseq AND DELETED = 0 AND (json_extract(data, '$.date') > '2025-01-01')`,
       `ORDER BY json_extract(data, '$.date') ASC`,
       `LIMIT 100;`
@@ -197,7 +198,7 @@ describe('makeSQLQueryFromMango', () => {
 
     const expectedSql = [
       `SELECT 'by-sequence'.json AS data, 'by-sequence'.doc_id, 'by-sequence'.rev`,
-      `FROM 'by-sequence' INDEXED BY by_name, 'document-store'`,
+      `FROM 'by-sequence' INDEXED BY 'by_name', 'document-store'`,
       `WHERE 'by-sequence'.seq = 'document-store'.winningseq AND DELETED = 0 AND (json_extract(data, '$.date') > '2025-01-01')`,
       `LIMIT 200 OFFSET 100;`
     ].join(' ')
@@ -226,6 +227,33 @@ describe('makeSQLQueryFromMango', () => {
     expect(sql).not.toContain('LIMIT null')
     expect(sql).toContain('LIMIT -1 OFFSET 10;')
   })
+
+  it('should quote an index name a partial filter made non-alphanumeric', () => {
+    const selector = { date: { $gt: '2025-01-01' } }
+    const indexName = 'by_date_filter_(_id_$nin_(io.cozy.files.trash-dir))'
+    const sql = makeSQLQueryFromMango({ selector, indexName, limit: 100 })
+
+    expect(sql).toContain(`INDEXED BY '${indexName}'`)
+  })
+
+  it('escapes a quote a partial filter value put in the index name', () => {
+    const indexName = "by_name_filter_(name_$ne_O'Brien)"
+    const escaped = "by_name_filter_(name_$ne_O''Brien)"
+    const query = makeSQLQueryFromMango({
+      selector: { date: { $gt: '2025-01-01' } },
+      indexName,
+      limit: 100
+    })
+
+    // The three statements must name the same index, so they escape alike.
+    expect(query).toContain(`INDEXED BY '${escaped}'`)
+    expect(makeSQLCreateMangoIndex(indexName, ['name'], {})).toContain(
+      `CREATE INDEX IF NOT EXISTS '${escaped}'`
+    )
+    expect(makeSQLDropIndex(indexName)).toBe(
+      `DROP INDEX IF EXISTS '${escaped}';`
+    )
+  })
 })
 
 describe('makeSQLQueryAll', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cozy-pouch-link",
-  "version": "60.36.1",
+  "version": "60.36.2",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "types/index.d.ts",
@@ -41,5 +41,5 @@
     "typecheck": "tsc -p tsconfig.json"
   },
   "sideEffects": false,
-  "gitHead": "113938e0db48b2fa03eb2afdd495757a29f2bb5a"
+  "gitHead": "ba55d3b65b937785254c369ef2bc86ad31cbc658"
 }