Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adapter-commons/filter-query.ts:cleanQuery whitelist test #1540

Closed
TimNZ opened this issue Aug 31, 2019 · 3 comments
Closed

adapter-commons/filter-query.ts:cleanQuery whitelist test #1540

TimNZ opened this issue Aug 31, 2019 · 3 comments

Comments

@TimNZ
Copy link
Contributor

TimNZ commented Aug 31, 2019

I've added additional known operators to whitelist option for feathers-sequelize, but cleanQuery is also failing things like '"$primaryLocation.city$".

Is it reasonable that sequelize field expressions are blacklisted by default, or can you test for $ at start and end and allow, or have that as another option along whitelist,
or support regexp values in whitelist?

@daffl
Copy link
Member

daffl commented Sep 4, 2019

It almost looks like we'd want to be able to whitelist a regular expression.

@TimNZ
Copy link
Contributor Author

TimNZ commented Sep 4, 2019

Yes please - loop through array and test if item is string or regexp and test accordingly,
vs current 'includes' test.

@daffl
Copy link
Member

daffl commented Dec 9, 2022

So over the last little while we realised that all the query sanitisation is just a complicated and convoluted way of doing query schema validation which is exactly what we'd like to encourage in the future. So #2906 implemented a change that skips query sanitisation if you already validated your query against a schema which will be the recommended way going forward.

@daffl daffl closed this as completed Dec 9, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants