archive-gh-me/node-postgres
1
0
Fork 0
mirror of https://github.com/brianc/node-postgres.git synced 2026-01-18 15:55:05 +00:00
Code Issues Projects Releases Wiki Activity

fix: do not concatenate an array if passed to escapeLiteral. (#3489)

Browse Source
This commit is contained in:
Brian C 2025-06-14 16:36:32 -05:00 committed by GitHub
parent 114a03e887
commit 8608fb84c8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 38 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
packages/pg/lib/utils.js
View File

@ -176,6 +176,14 @@ const escapeLiteral = function (str) {
let hasBackslash = false
let escaped = "'"
if (str == null) {
return "''"
}
if (typeof str !== 'string') {
return "''"
}
for (let i = 0; i < str.length; i++) {
const c = str[i]
if (c === "'") {

49
packages/pg/test/unit/utils-tests.js
View File

@ -232,35 +232,46 @@ test('prepareValue: can safely be used to map an array of values including those
})
const testEscapeLiteral = function (testName, input, expected) {
test(testName, function () {
test(`escapeLiteral: ${testName}`, function () {
const actual = utils.escapeLiteral(input)
assert.equal(expected, actual)
})
}
testEscapeLiteral('escapeLiteral: no special characters', 'hello world', "'hello world'")
testEscapeLiteral('escapeLiteral: contains double quotes only', 'hello " world', "'hello \" world'")
testEscapeLiteral('no special characters', 'hello world', "'hello world'")
testEscapeLiteral('escapeLiteral: contains single quotes only', "hello ' world", "'hello '' world'")
testEscapeLiteral('contains double quotes only', 'hello " world', "'hello \" world'")
testEscapeLiteral('escapeLiteral: contains backslashes only', 'hello \\ world', " E'hello \\\\ world'")
testEscapeLiteral('contains single quotes only', "hello ' world", "'hello '' world'")
testEscapeLiteral('escapeLiteral: contains single quotes and double quotes', 'hello \' " world', "'hello '' \" world'")
testEscapeLiteral('contains backslashes only', 'hello \\ world', " E'hello \\\\ world'")
testEscapeLiteral('contains single quotes and double quotes', 'hello \' " world', "'hello '' \" world'")
testEscapeLiteral('date', new Date(), "''")
testEscapeLiteral('null', null, "''")
testEscapeLiteral('undefined', undefined, "''")
testEscapeLiteral('boolean', false, "''")
testEscapeLiteral('number', 1, "''")
testEscapeLiteral('number', 1, "''")
testEscapeLiteral('boolean', true, "''")
testEscapeLiteral('array', [1, 2, 3], "''")
testEscapeLiteral('object', { x: 42 }, "''")
testEscapeLiteral('contains double quotes and backslashes', 'hello \\ " world', " E'hello \\\\ \" world'")
testEscapeLiteral('contains single quotes and backslashes', "hello \\ ' world", " E'hello \\\\ '' world'")
testEscapeLiteral(
'escapeLiteral: contains double quotes and backslashes',
'hello \\ " world',
" E'hello \\\\ \" world'"
)
testEscapeLiteral(
'escapeLiteral: contains single quotes and backslashes',
"hello \\ ' world",
" E'hello \\\\ '' world'"
)
testEscapeLiteral(
'escapeLiteral: contains single quotes, double quotes, and backslashes',
'contains single quotes, double quotes, and backslashes',
'hello \\ \' " world',
" E'hello \\\\ '' \" world'"
)