954354f · squeal · git.iko.soy

circle.yml+1

compare with dev

unifiedsplit

@@ -4,6 +4,7 @@ dependencies:

4 - ".stack-work"

5 override:

6 - stack setup

7+ - stack test --no-run-tests

7test:

8test:

8 override:

9 override:

9 - stack test

10 - stack test

squeel-postgresql/src/Squeel/PostgreSQL/Query.hs+14−1

@@ -3,6 +3,7 @@

3 , FlexibleContexts

4 , FlexibleInstances

5 , GADTs

6+ , LambdaCase

6 , MultiParamTypeClasses

7 , MultiParamTypeClasses

7 , OverloadedStrings

8 , OverloadedStrings

8 , PolyKinds

9 , PolyKinds

@@ -118,7 +119,19 @@ instance HasField label xs x => IsLabel label (Expression ps xs x) where

118 fieldName (Proxy @label) (Proxy @xs) (Proxy @x)

119 fieldName (Proxy @label) (Proxy @xs) (Proxy @x)

119

120

120instance IsString (Expression ps xs 'PGText) where

121instance IsString (Expression ps xs 'PGText) where

121− fromString str = UnsafeExpression $ "\'" <> fromString str <> "\'"

122+ fromString str = UnsafeExpression $

123+ "E\'" <> fromString (escape =<< str) <> "\'"

124+ where

125+ escape = \case

126+ '\NUL' -> "\\0"

127+ '\'' -> "''"

128+ '"' -> "\\\""

129+ '\b' -> "\\b"

130+ '\n' -> "\\n"

131+ '\r' -> "\\r"

132+ '\t' -> "\\t"

133+ '\\' -> "\\\\"

134+ c -> [c]

122

135

123instance Num (Expression ps xs 'PGInt2) where

136instance Num (Expression ps xs 'PGInt2) where

124 fromInteger n = UnsafeExpression . fromString $ show n

137 fromInteger n = UnsafeExpression . fromString $ show n

squeel-postgresql/test/Squeel/PostgreSQL/QuerySpec.hs+3−4

@@ -55,10 +55,9 @@ spec = do

55 `shouldBe`

56 "INSERT INTO table1 (col1, col2) VALUES (2, 4);"

57 it "should be safe against SQL injection in literal text" $ do

58− pendingWith "gotta find an escape function"

59− -- renderQuery (select (literalText `from` table1))

58+ renderQuery (select (literalText `from` table1))

60− -- `shouldBe`

59+ `shouldBe`

61− -- "SELECT '\\'DROP TABLE table1;' AS literal FROM table1;"

60+ "SELECT E''';DROP TABLE table1;' AS literal FROM table1;"

62

61

63type Columns = '[ '("col1", 'PGInt4), '("col2", 'PGInt4)]

62type Columns = '[ '("col1", 'PGInt4), '("col2", 'PGInt4)]

64type Tables = '[ '("table1", Columns)]

63type Tables = '[ '("table1", Columns)]