Skip to content

Commit 6b77f34

Browse files
authored
validate right operand while escaping an comparison (#115)
* validate right operand while escaping an comparison * 2.14.7
1 parent 3617b29 commit 6b77f34

File tree

5 files changed

+26
-6
lines changed

5 files changed

+26
-6
lines changed

package-lock.json

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@themost/query",
3-
"version": "2.14.6",
3+
"version": "2.14.7",
44
"description": "MOST Web Framework Codename ZeroGravity - Query Module",
55
"main": "dist/index.cjs.js",
66
"module": "dist/index.esm.js",

spec/OpenDataQuery.select.spec.js

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -259,4 +259,14 @@ describe('OpenDataQuery.select', () => {
259259
expect(result.$select).toEqual('id,familyName,givenName,concat(concat(givenName,\' \'),familyName) as name');
260260
});
261261

262+
it('should use simple or statement', () => {
263+
const query = new OpenDataQuery().from('Products')
264+
.where('category').equal('Laptops').or('category').equal('Desktops')
265+
.orderBy('price')
266+
.take(10);
267+
const formatter = new OpenDataQueryFormatter();
268+
let result = formatter.formatSelect(query);
269+
expect(result).toBeTruthy();
270+
})
271+
262272
});

src/formatter.js

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,14 @@ class SqlFormatter {
166166
} else if (keys.length === 1) {
167167
// backward compatibility for simple equal expression
168168
// e.g. { "category": "Laptops" }
169-
return this.$eq(new QueryField(key0), value[key0]);
169+
const value0 = value[key0];
170+
if (value0 == null) {
171+
return this.$eq(new QueryField(key0), null);
172+
}
173+
if ((typeof value0 === 'object' && Object.prototype.hasOwnProperty.call(value0, '$eq')) === false) {
174+
throw new Error('Invalid right operand. Expected an object with $eq operator.');
175+
}
176+
return this.$eq(new QueryField(key0), value0.$eq);
170177
}
171178
}
172179
}

src/open-data-query.formatter.js

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,12 @@ class OpenDataQueryFormatter extends SqlFormatter {
1616
}
1717

1818
escapeRight(value) {
19+
if (value == null) {
20+
return super.escape(value);
21+
}
1922
if (Object.prototype.hasOwnProperty.call(value, '$name'))
2023
return `$it/${this.escapeName(value.$name)}`;
21-
return super.escape(value)
24+
return super.escape(value);
2225
}
2326

2427
$startswith(p0, p1) {
@@ -572,4 +575,4 @@ export {
572575
today,
573576
whoami,
574577
OpenDataQueryFormatter
575-
}
578+
}

0 commit comments

Comments
 (0)