github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

_search= queries now correctly escaped, fixes #651

Browse source 
Queries with reserved words or characters according to the SQLite
FTS5 query language could cause errors.

Queries are now escaped like so:

    dog cat => "dog" "cat"
This commit is contained in:
Simon Willison 2019-12-29 18:48:13 +00:00
commit 3c861f363d
6 changed files with 47 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
datasette/views/table.py
View file

@ -361,7 +361,7 @@ class TableView(RowTableShared):
# Simple ?_search=xxx
search = search_args["_search"]
where_clauses.append(
"{fts_pk} in (select rowid from {fts_table} where {fts_table} match :search)".format(
"{fts_pk} in (select rowid from {fts_table} where {fts_table} match escape_fts(:search))".format(
fts_table=escape_sqlite(fts_table), fts_pk=escape_sqlite(fts_pk)
)
)
@ -375,7 +375,7 @@ class TableView(RowTableShared):
raise DatasetteError("Cannot search by that column", status=400)
where_clauses.append(
"rowid in (select rowid from {fts_table} where {search_col} match :search_{i})".format(
"rowid in (select rowid from {fts_table} where {search_col} match escape_fts(:search_{i}))".format(
fts_table=escape_sqlite(fts_table),
search_col=escape_sqlite(search_col),
i=i,