supabase / supabase-flutter / 28583270853

86%

push

github

fix(realtime): escape quotes and backslashes in `in` filter values (#1506)

## What

`PostgresChangeFilter.toString()` builds the `in` filter by quoting each
value, but never escapes the value first. A value containing a double
quote or backslash produces a malformed filter:

```dart
PostgresChangeFilter(
  type: PostgresChangeFilterType.inFilter,
  column: 'name',
  value: ['a"b'],
).toString();
// name=in.("a"b")  <-- the inner " breaks the quoted element
```

This escapes `\` and `"` inside each element before quoting, so the
value stays a single well-formed token.

## Why

The realtime `in` filter had the same missing-escaping bug that was
fixed for postgrest in #1481 (`_cleanFilterArray`), but the realtime
copy in `types.dart` was never updated:

```dart
return '$column=in.(${value.map((s) => '"$s"').join(',')})';
```

Any subscription filtering on a list whose values contain `"` or `\`
sends a broken filter to the Realtime server. The fix mirrors the
PostgREST/PostgreSQL array quoting used by `PostgrestFilterBuilder`:

```dart
final escaped = '$s'.replaceAll(r'\', r'\\').replaceAll('"', r'\"');
return '"$escaped"';
```

## Not a breaking change

Values without `"` or `\` render exactly as before
(`in.("active","pending")`), and non-`in` filters are untouched. Only
previously-malformed output changes.

## Tests

Added `packages/realtime_client/test/postgres_change_filter_test.dart`:
asserts `['a"b\c']` renders as `name=in.("a\"b\\c")`, that plain values
are unchanged, and that non-`in` filters are unaffected. The escaping
test fails on the old code (`Actual: name=in.("a"b\c")`) and passes with
the fix. `dart format` and `dart analyze --fatal-warnings` are clean.

---------

Co-authored-by: Lukas Klingsbo <lukas.klingsbo@gmail.com>

4 of 4 new or added lines in 1 file covered. (100.0%)

4203 of 4892 relevant lines covered (85.92%)

3.94 hits per line