nushell
nushell copied to clipboard
`stor insert` does not escape single quotes
Describe the bug
When using stor insert to add a row, it will not escape any strings that contain single quotes.
How to reproduce
$ stor create -t test -c { value: str }
$ stor insert -t history -d { command_line: "'hello world'" }
Error: × Failed to open SQLite connection in memory from insert
╭─[source:1:1]
1 │ nu --login
· ▲
· ╰── near "hello": syntax error in INSERT INTO history ( command_line) VALUES ( ''hello world'') at offset 47
╰────
Expected behavior
I'd expect strings to be properly escaped so that pipelines don't accidentally cause SQL injection bugs.
Screenshots
No response
Configuration
| key | value |
|---|---|
| version | 0.93.0 |
| major | 0 |
| minor | 93 |
| patch | 0 |
| branch | |
| commit_hash | |
| build_os | macos-aarch64 |
| build_target | aarch64-apple-darwin |
| rust_version | rustc 1.77.2 (25ef9e3d8 2024-04-09) (Homebrew) |
| cargo_version | cargo 1.77.2 |
| build_time | 2024-04-30 22:51:13 +00:00 |
| build_rust_channel | release |
| allocator | mimalloc |
| features | dataframe, default, sqlite, system-clipboard, trash, which |
| installed_plugins | ulid |
Additional context
You can currently workaround this by feeding any input strings through
str replace "'" "''" -a
Not surprised. We'd accept a PR to fix this. Thanks.
I think I can take a quick look at this one