Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Reliably quote columns/tables #1400

Merged
merged 12 commits into from
Feb 2, 2023
Merged

fix: Reliably quote columns/tables #1400

Changes from 5 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
b6512f2
refactor: easily quote table/column
bf4 Jan 31, 2023
64520ca
refactor: extract table name when missing
bf4 Jan 31, 2023
eb79124
fix: Reliably quote columns/tables
bf4 Jan 31, 2023
d332579
refactor: putting quoting methods together
bf4 Jan 31, 2023
f72b46a
fix: typo-ish
bf4 Jan 31, 2023
6e446a9
test: where is the bad mysql expectation coming from?
bf4 Jan 31, 2023
68b00ba
fix: hack mysql test query comparison
bf4 Jan 31, 2023
6bf350f
fix: hack mysql query comparison
bf4 Jan 31, 2023
765e68d
test: always sql for compare
bf4 Jan 31, 2023
55c3f23
fix: correct adapter name
bf4 Jan 31, 2023
c21667a
Handle special case of *
bf4 Jan 31, 2023
15d0ec6
chore: update per review
bf4 Feb 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 33 additions & 10 deletions lib/jsonapi/active_relation_resource.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -800,18 +800,29 @@ def sort_records(records, order_options, options)
apply_sort(records, order_options, options)
end

def sql_field_with_alias(table, field, quoted = true)
Arel.sql("#{concat_table_field(table, field, quoted)} AS #{alias_table_field(table, field, quoted)}")
end

def concat_table_field(table, field, quoted = false)
if table.blank? || field.to_s.include?('.')
if table.blank?
split_table, split_field = field.to_s.split('.')
if split_table && split_field
table = split_table
field = split_field
end
end
if table.blank?
# :nocov:
if quoted
quote(field)
quote_column_name(field)
else
field.to_s
end
# :nocov:
else
if quoted
"#{quote(table)}.#{quote(field)}"
"#{quote_table_name(table)}.#{quote_column_name(field)}"
else
# :nocov:
"#{table.to_s}.#{field.to_s}"
Expand All @@ -820,32 +831,44 @@ def concat_table_field(table, field, quoted = false)
end
end

def sql_field_with_alias(table, field, quoted = true)
Arel.sql("#{concat_table_field(table, field, quoted)} AS #{alias_table_field(table, field, quoted)}")
end

def alias_table_field(table, field, quoted = false)
if table.blank? || field.to_s.include?('.')
# :nocov:
if quoted
quote(field)
quote_column_name(field)
else
field.to_s
end
# :nocov:
else
if quoted
# :nocov:
quote("#{table.to_s}_#{field.to_s}")
quote_column_name("#{table.to_s}_#{field.to_s}")
# :nocov:
else
"#{table.to_s}_#{field.to_s}"
end
end
end

def quote_table_name(table_name)
if _model_class.try(:connection)
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could be _model_class&.connection

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this would be better now that we don't support ruby versions older than 2.3

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking 'what if _model_class exists but doesn't respond to connection' but then I was thinking 'this is the ar resource, it's fine', but then I was thinking, ... eh

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated to &.

_model_class.connection.quote_table_name(table_name)
else
quote(table_name)
end
end

def quote_column_name(column_name)
if _model_class.try(:connection)
_model_class.connection.quote_column_name(column_name)
else
quote(column_name)
end
end

def quote(field)
"\"#{field.to_s}\""
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in pg, is basically quote_ident. for values, should be single-quotes like quote_literal

%{"#{field.to_s}"}
end

def apply_filters(records, filters, options = {})
Expand Down