From 641e72fc0d056db8976a344e5bfbd5cb336f7254 Mon Sep 17 00:00:00 2001 From: Denis Bykhov Date: Mon, 18 Nov 2024 21:29:52 +0500 Subject: [PATCH] Fix pg escape (#7187) Signed-off-by: Denis Bykhov --- server/postgres/src/storage.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/postgres/src/storage.ts b/server/postgres/src/storage.ts index 493421695b..bb4d75d232 100644 --- a/server/postgres/src/storage.ts +++ b/server/postgres/src/storage.ts @@ -484,7 +484,7 @@ abstract class PostgresAdapterBase implements DbAdapter { const key = domain === DOMAIN_SPACE ? '_id' : domain === DOMAIN_TX ? "data ->> 'objectSpace'" : 'space' const privateCheck = domain === DOMAIN_SPACE ? ' OR sec.private = false' : '' const q = `(sec.members @> '{"${acc._id}"}' OR sec."_class" = '${core.class.SystemSpace}'${privateCheck})` - return `INNER JOIN ${translateDomain(DOMAIN_SPACE)} AS sec ON sec._id = ${domain}.${key} AND sec."workspaceId" = '${this.workspaceId.name}' AND ${q}` + return `INNER JOIN ${translateDomain(DOMAIN_SPACE)} AS sec ON sec._id = ${domain}.${escapeBackticks(key)} AND sec."workspaceId" = '${this.workspaceId.name}' AND ${q}` } } } @@ -1019,7 +1019,7 @@ abstract class PostgresAdapterBase implements DbAdapter { res.push(`${tkey} IS ${val === true ? 'NOT NULL' : 'NULL'}`) break case '$regex': - res.push(`${tkey} SIMILAR TO '${val}'`) + res.push(`${tkey} SIMILAR TO '${escapeBackticks(val)}'`) break case '$options': break