yesodweb / yesodweb/persistent

[Suggestion] Add `Like` in `PersistFilter`

Open
#841 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Haskell
Stars
486
Forks
306
PR merge metrics
No merged PRs in 30d

Description

Currently, we need to use BackendSpecificFilter to represent LIKE operator. Since there's no sanity check for wildcard characters, there's chance that they are injected via user's input.

For example, let's say we want to SELECT books LIKE authors which start with the user's input, we can write like this:

books <- runDB $ selectList [Filter BookAuthor (Left $ concat [author, "%"]) (BackendSpecificFilter "LIKE")] [Asc BookId]

If users pass inputs something like %Haskell as author, WHERE clause would be %Haskell% and the result would become books which contain Haskell, which we didn't expect.

To solve this problem, I think we need to add value Like in PersistFilter and provide helper functions like these.

Any thoughts?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the PersistFilter definition in Database.Persist.Types.Base.html and compare it with the helper functions linked from Database-Persist.html. Trace how BackendSpecificFilter produces the LIKE condition, then determine the required PersistFilter value and helper behavior so user input cannot unintentionally broaden the match; done means the supported LIKE use case is represented without BackendSpecificFilter.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell, sql
Domain
databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.