Hi guys, I'm using the inFormat
template function for an IN clause in a SQL file, as shown in the docs example. I've discovered a detail: it can't do the IN because of a formatting error.
Using it as the query params it turns out that it only joins the options.
http://localhost:8081/_QUERIES/dir/customquery?field1=test1,test2
SELECT * FROM table WHERE name IN {{inFormat "field1"}};
And what I got was basically the combination of these terms.
name in ('test1,test2')
The solution I found was to add quotes to complete the name (i.e.: ?field1=test1','test2
), however, this is a terrible solution and looks like SQL Injection (LOL). Going deeper into the code and doing some tests on this function, I noticed that it tries to transform the string into a string slice.
https://github.com/prest/prest/blob/b7107b18d277e85f3155d5eb015dfd9c8a8a729c/template/funcregistry.go#L42-L50
Following this concept, what I've done was: The function receives the string and after that, it's sliced into []string
.
str := fr.TemplateData[key].(string)
split := strings.Split(str, ",")
query = fmt.Sprintf("('%s')", strings.Join(split, "', '"))
I saw that there is a split function but I couldn't use it inside inFormat
.
- pREST: latest version
- pREST endpoint: custom query
- PostgreSQL version: 12
- OS: Manjaro Linux x86_64
- Go version: go1.19.4 Linux/amd64
- Log gist: https://gist.github.com/caiolul/14e908f4f845b3b2cf31c84ec9268b11
bug question feature product/api-server