From 92a1d8c7e375a4c8da0f3abfe937cb640295e8c2 Mon Sep 17 00:00:00 2001 From: Ruslan Talpa Date: Sat, 5 Sep 2015 16:54:09 +0300 Subject: [PATCH] constrain cast parameters to letters only --- src/PostgREST/PgQuery.hs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/PostgREST/PgQuery.hs b/src/PostgREST/PgQuery.hs index 450a13eaf..19a0cca34 100644 --- a/src/PostgREST/PgQuery.hs +++ b/src/PostgREST/PgQuery.hs @@ -143,7 +143,8 @@ select table params = selectTerm :: QualifiedIdentifier -> T.Text -> PStmt selectTerm table col = case T.splitOn "::" col of - [colName,castTo] -> B.Stmt ("CAST (" <> pgFmtJsonbPath table (cs colName) <> " AS " <> castTo <> " )" <> asT (jsonbPath colName)) empty True + [colName,castTo] -> B.Stmt ("CAST (" <> pgFmtJsonbPath table (cs colName) <> " AS " <> castToSafe <> " )" <> asT (jsonbPath colName)) empty True + where castToSafe = T.filter ( `elem` ['a'..'z'] ) castTo _-> B.Stmt (pgFmtJsonbPath table (cs col) <> asT (jsonbPath col)) empty True where jsonbPath :: T.Text -> Maybe JsonbPath