Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: correct mongo-knex regexp resolution with relations #47

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

hiendv
Copy link

@hiendv hiendv commented Oct 18, 2022

This solves issue with relation regexp filtering.
http://localhost:2368/ghost/api/v4/content/posts/?key=redacted&filter=tag:~'foo'

{"errors":[{"message":"Internal server error, cannot list posts.","context":"select count(distinct posts.id) as aggregate from `posts` where (`posts`.`status` = 'published' and (`posts`.`type` = 'post' and `posts`.`id` in (select `posts_tags`.`post_id` from `posts_tags` inner join `tags` on `tags`.`id` = `posts_tags`.`tag_id` where `tags`.`slug` like {}))) - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')))' at line 1","type":"InternalServerError","details":null,"property":null,"help":null,"code":"ER_PARSE_ERROR","id":"redacted","ghostErrorCode":null}]}

I thought of using Knex Like and ILike but for now it won't work because of COLLATION 'utf8_bin'.
COLLATION 'utf8_bin' is not valid for CHARACTER SET 'latin1'

The behavior aligns with commit 7b8798a.
MySQL case-sensitive LIKEs also won't work without casting to BINARY.
For an actual database agnostic solution, we need to rework everything around this.

I tried some SQL Injection test cases but NQL parser works well 😆

@ErisDS
Copy link
Member

ErisDS commented Oct 26, 2022

Hey sorry @hiendv I apparently wasn't watching this repo properly, and missed this. I will review it ASAP.

In the meantime could you confirm what version of MySQL did you find this issue on?

Thanks 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants