Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Escape strings in RemoveClause #334

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Escape strings in RemoveClause #334

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions lib/neo4j/core/query_clauses.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -643,9 +643,7 @@ def from_key_and_value(key, value)
case value
when /^:/
"#{key}:`#{value[1..-1]}`"
when String
"#{key}.#{value}"
when Symbol
when String, Symbol
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this change does not make sense.

"#{key}.#{value}"

is not the same as

"#{key}:`#{value}`"

The former references a property the latter tests a node if it has a label. Use dot notation with escape and that probably will be good although readability of logs may suffer. Maybe there is a way to escape only when necessary.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh I completely missed that there was a different delimiter there, good catch, that is probably also a semi-significant cause of the test errors. It seems like escape handling isn't really standardized, I discovered this particular issue in a chained method that ended in .delete, where it properly escaped everything up until then.

I'm not sure if it makes sense to check if a string needs to be delimited, that is a recipe for injection attacks, and it would incur a slight performance penalty.

This is my first contribution, but it also seems strange to have a distiction between passing a string vs. a symbol to delete. The documentation for delete seems to indicate that there shouldn't be a difference: https://neo4jrb.readthedocs.io/en/v9.4.0/QueryClauseMethods.html#delete. If there should be a distinction, it should be documented.

"#{key}:`#{value}`"
when Array
value.map do |v|
Expand Down