microlinkhq / keyvhq / 40745992793

97%

push

github

fix(sql): escape backslashes in MySQL keys and patterns (#290)

* test(mysql): round-trip special keys and namespaces, reject injection

Covers keys containing ', \, \', %, _ and a literal backslash-n, a key
that closes the string literal with a backslash, numeric keys passed
to the store, and namespaces containing \, % and _ next to look-alike
namespaces. On master, set() throws a syntax error for a key ending
in a backslash, get("nope\\') OR 1=1 -- ") returns another key's
value, delete() with the same key removes every row, and iterator()
returns nothing for namespace a\b.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(sql): escape backslashes in MySQL keys and patterns

sql-ts inlines literals and only doubles single quotes. MySQL also
treats backslash as an escape character, so a key containing \' ended
the string literal early and the rest of the key ran as SQL: get()
could read another row and delete() could remove the whole table. A
key ending in a backslash made set() fail with a syntax error, and
sequences like \n were stored as control characters.

set() already escaped backslashes in the value for MySQL. Apply the
same escaping to the key in get, set and delete. Non-string keys pass
through unchanged, as before.

The LIKE pattern in clear and iterator is read twice by MySQL: once as
a string literal, then as a LIKE pattern, where \ escapes and % and _
are wildcards. Escape \, % and _ in the namespace for LIKE first, then
escape backslashes for the literal, so a namespace matches only its
own keys. Other dialects are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(sql): escape String objects and non-string namespaces

sql-ts inlines String objects with toString(), so a boxed key or value
skipped MySQL backslash escaping and could still break out of a literal.
value.replace used to accept those objects. A numeric namespace called
replace and threw, instead of matching the coerced prefix.

Co-author... (continued)

364 of 390 branches covered (93.33%)

Branch coverage included in aggregate %.

55 of 57 new or added lines in 1 file covered. (96.49%)

1067 of 1083 relevant lines covered (98.52%)

70.89 hits per line