yesodweb / yesodweb/persistent
[Suggestion] Add `Like` in `PersistFilter`
Nobody has claimed this yet.
- Dominant language
- Haskell
- Stars
- 486
- Forks
- 306
- PR merge metrics
- No merged PRs in 30d
Description
Currently, we need to use BackendSpecificFilter to represent LIKE operator. Since there's no sanity check for wildcard characters, there's chance that they are injected via user's input.
For example, let's say we want to SELECT books LIKE authors which start with the user's input, we can write like this:
books <- runDB $ selectList [Filter BookAuthor (Left $ concat [author, "%"]) (BackendSpecificFilter "LIKE")] [Asc BookId]
If users pass inputs something like %Haskell as author, WHERE clause would be %Haskell% and the result would become books which contain Haskell, which we didn't expect.
To solve this problem, I think we need to add value Like in PersistFilter and provide helper functions like these.
Any thoughts?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the PersistFilter definition in Database.Persist.Types.Base.html and compare it with the helper functions linked from Database-Persist.html. Trace how BackendSpecificFilter produces the LIKE condition, then determine the required PersistFilter value and helper behavior so user input cannot unintentionally broaden the match; done means the supported LIKE use case is represented without BackendSpecificFilter.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell, sql
- Domain
- databases
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100