Skip to main content

sanitizeQueryLiterals

@webda/core

Function: sanitizeQueryLiterals()

sanitizeQueryLiterals(model, query): Promise<boolean>

Defined in: packages/core/src/models/permissions.ts:741

Sanitize the string literals of a client query the way the texts they are compared with were sanitized when they were written

A client query is not HTML-sanitized as a whole, on any transport: its grammar is its validation, and escaping it breaks < and >. But the texts it is compared with are stored sanitized (R&D is stored R&amp;D in an attribute with the default sanitization, as written in a @sanitize none one). So each string literal, and each string of an IN list, is sanitized with the mode of the attribute it is compared with, by the functions of the write path (sanitizeString): a client finds a text with the value it sent.

  • the mode comes from the Input schema of model (the queried model: a subclass tagging the same attribute another way is not looked at); an attribute the schema does not know, or that is not a text, gets the default;
  • a CONTAINS literal has the mode of the items of the attribute (tags.*);
  • numbers, booleans, null and dynamic values (NOW()) are left alone;
  • the parsed query is changed, never its text: a literal cannot alter the structure of the query.

Only for queries written by a client. A query written by the application (Model.query(), a permission query) compares with the stored values as they are: nothing is rewritten.

Parameters​

model​

any

the model class the query is run on

query​

QueryValidator

the parsed client query, modified in place

Returns​

Promise<boolean>

true when a literal was changed

Throws​

SanitizerUnavailable when a literal is compared with a markdown attribute and micromark is not installed