Escape identifiers in arraycontains/arraynotcontains filters (refs #2431)#2853
Open
winklemad wants to merge 1 commit into
Open
Escape identifiers in arraycontains/arraynotcontains filters (refs #2431)#2853winklemad wants to merge 1 commit into
winklemad wants to merge 1 commit into
Conversation
The array-membership filters built SQL with literal bracket quoting (json_each([table].[column])), which cannot escape a "]" in a table or column name, so filtering an array column whose name contains "]" failed with a SQLite syntax error even though the table page loaded fine. Use escape_sqlite() for the table and column identifiers, matching the approach taken in simonw#2846 for the array facet SQL. Refs simonw#2431
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
arraycontains/arraynotcontainsfilters build their SQL with literal bracket quoting:":{p} in (select value from json_each([{t}].[{c}]))"Bracket quoting can't escape a
]inside an identifier, so filtering a JSON-array column whose table or column name contains]produces malformed SQL and fails, even though the table page itself loads fine:Fix
Use
escape_sqlite()(already imported) for the table and column identifiers — the same approach #2846 used for the array facet SQL, which fixed this bug class for facets but left the array filters untouched. After the fix the generated SQL is... json_each("normal"."ta]gs") ...and the filter returns the correct rows.Refs #2431.
Tests
Updated the two exact-SQL assertions in
tests/test_filters.pyto the escaped form and added]-in-name regression cases.pytest tests/test_filters.py tests/test_facets.py tests/test_table_api.pypasses;black/ruffclean.Related follow-ups (not in this PR)
Other literal
[{...}]identifier-quoting sites remain (per #2431):app.pyATTACH DATABASE, and a few inviews/table.py(label/autocomplete, drop-table confirm, keyset-pagination fallback). Happy to follow up on those separately if you'd like.