supabase / supabase / 25805812665

76%

push

github

fix: escape quotes (#45848)

## TL;DR


- closes https://github.com/supabase/supabase/issues/45860
- closes https://github.com/supabase/supabase/issues/45544
 & supersedes https://github.com/supabase/supabase/pull/45543


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added explicit allowed facet fields and validation to prevent invalid
facet usage.

* **Bug Fixes**
* Improved filter handling by coercing values to strings and properly
escaping single quotes for array, scalar, and LIKE filters (including
facet search), reducing query errors and injection risks.
* Enhanced parsing of scheduled-job SQL commands to tolerate varied
casing/whitespace and strip leading SELECT before processing.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45848)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

944 of 1334 branches covered (70.76%)

Branch coverage included in aggregate %.

1450 of 2011 relevant lines covered (72.1%)

248.45 hits per line