Skip to content

Conversation

@gregnr
Copy link
Member

@gregnr gregnr commented Oct 17, 2025

Adds an optional parameters field to the /query request body that allow consumers to bind parameters to a query. e.g.

{
  "query": "SELECT * FROM users WHERE id = $1 AND status = $2",
  "parameters": [1, "ACTIVE"],
}

This will help protect against SQL injection vulnerabilities.

@gregnr gregnr requested review from a team as code owners October 17, 2025 16:00
@coveralls
Copy link

coveralls commented Oct 17, 2025

Pull Request Test Coverage Report for Build 18598892858

Details

  • 9 of 10 (90.0%) changed or added relevant lines in 2 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage increased (+0.01%) to 82.958%

Changes Missing Coverage Covered Lines Changed/Added Lines %
src/lib/db.ts 8 9 88.89%
Totals Coverage Status
Change from base Build 18564204053: 0.01%
Covered Lines: 5924
Relevant Lines: 7000

💛 - Coveralls

Copy link
Member

@avallete avallete left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Querystring: {
statementTimeoutSecs?: number
}
Body: { query: string; parameters?: any[] }
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpick

parameters?: unknown[] ? To match what's declared in the PostgresMeta.ts

Suggested change
Body: { query: string; parameters?: any[] }
Body: { query: string; parameters?: unknown[] }

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whoops, missed that one. Updating, thanks

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gregnr gregnr merged commit b813a03 into master Oct 17, 2025
6 checks passed
@gregnr gregnr deleted the feat/parameter-binding branch October 17, 2025 16:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants