crecto icon indicating copy to clipboard operation
crecto copied to clipboard

Positional arguments sometimes break interpolation

Open faultyserver opened this issue 7 years ago • 0 comments

(Sorry I don't have time to reduce this or find the root cause at the moment.)

I seem to have hit an interesting case in how query strings are generated that causes them to be apparently corrupted. Here's an example of the invalid query string:

INSERT INTO acc_users (name, discord, twitch, twitter, timezone, admin, avatar_object_id, encrypted_password, created_at, updated_at) VALUES ('testing', '', '', '', '', '', '', ''2018-09-30 13:24:03 UTC'a'2018-09-30 13:24:03 UTC'$hy9ZT6zG3k8P1gSDXFSX7.D19aAa2gj9CISzMDuDwgApCVioYYpYG', now(), now());

Of note here are the last three values of the row being inserted, namely the values for encrypted_password, created_at, and updated_at:

''2018-09-30 13:24:03 UTC'a'2018-09-30 13:24:03 UTC'$hy9ZT6zG3k8P1gSDXFSX7.D19aAa2gj9CISzMDuDwgApCVioYYpYG', now(), now());

It looks like the created_at and updated_at values have been interpolated inside of the value for the encrypted password. Specifically, by looking at the values before the query was generated, I saw that the password started with $2 and had a $1 in what looks like the same part of the password that is replaced by the updated_at value above. Also notably, the now() values for those fields are still present, which looks to me like they were supposed to be interpolated there but because they weren't, a default value was used instead.

I can't tell if this is a crecto issue or more low level in crystal-pg, and I haven't had time to look into a root cause. I don't have a minimal reproducing example, but all that I'm doing is creating an object, getting a changeset for it, and then calling Repo.insert(changeset). As a note, I was able to workaround this by disabling the created_at and updated_at fields on the schema.

faultyserver avatar Oct 01 '18 00:10 faultyserver