nushell icon indicating copy to clipboard operation
nushell copied to clipboard

`stor insert` does not escape single quotes

Open lizclipse opened this issue 1 year ago • 1 comments

Describe the bug

When using stor insert to add a row, it will not escape any strings that contain single quotes.

How to reproduce

$ stor create -t test -c { value: str }
$ stor insert -t history -d { command_line: "'hello world'" }
Error:   × Failed to open SQLite connection in memory from insert
   ╭─[source:1:1]
 1 │ nu --login
   · ▲
   · ╰── near "hello": syntax error in INSERT INTO history ( command_line) VALUES ( ''hello world'') at offset 47
   ╰────

Expected behavior

I'd expect strings to be properly escaped so that pipelines don't accidentally cause SQL injection bugs.

Screenshots

No response

Configuration

key value
version 0.93.0
major 0
minor 93
patch 0
branch
commit_hash
build_os macos-aarch64
build_target aarch64-apple-darwin
rust_version rustc 1.77.2 (25ef9e3d8 2024-04-09) (Homebrew)
cargo_version cargo 1.77.2
build_time 2024-04-30 22:51:13 +00:00
build_rust_channel release
allocator mimalloc
features dataframe, default, sqlite, system-clipboard, trash, which
installed_plugins ulid

Additional context

You can currently workaround this by feeding any input strings through

str replace "'" "''" -a

lizclipse avatar May 04 '24 16:05 lizclipse

Not surprised. We'd accept a PR to fix this. Thanks.

fdncred avatar May 04 '24 19:05 fdncred

I think I can take a quick look at this one

ExaltedBagel avatar May 10 '24 00:05 ExaltedBagel