supabase / supabase-flutter / 28287837914

86%

push

github

fix(postgrest): escape quotes and backslashes in list filter values (#1481)

## What

List filter values are now backslash-escaped before being quoted, so
values containing `"` or `\` produce well-formed PostgREST filters
instead of malformed ones.

## Why

`_cleanFilterArray` quoted each non-numeric element without escaping:

```dart
return filter.map((s) => '"$s"').join(',');
```

So `inFilter('name', ['a"b'])` generated `in.("a"b")`. PostgREST treats
the inner `"` as the end of the quoted element, so the filter is
mis-parsed and the query silently returns wrong results (or errors). The
same helper backs list `eq`/`neq`, `contains`/`containedBy`/`overlaps`,
`not`, and rpc array arguments, so all of them are affected.

The fix escapes `\` and `"` within each element, matching
PostgREST/PostgreSQL array-literal quoting:

```dart
final escaped = '$s'.replaceAll(r'\', r'\\').replaceAll('"', r'\"');
return '"$escaped"';
```

## Not a breaking change

Values without `"` or `\` are unaffected — the escaping is a no-op for
them, so existing valid filters generate identical query strings. Only
values that are currently broken change.

## Tests

Added `packages/postgrest/test/filter_escape_test.dart`:
`inFilter('name', [r'a"b\c'])` with a capturing mock client, asserting
the generated query is `in.("a\"b\\c")`. Without the fix it's the
malformed `in.("a"b\c")`.

4 of 4 new or added lines in 1 file covered. (100.0%)

4124 of 4815 relevant lines covered (85.65%)

3.72 hits per line