fix: escape single quotes in timeline-db WHERE filters + files.ts tests - #256
fix: escape single quotes in timeline-db WHERE filters + files.ts tests#256TerminalGravity wants to merge 3 commits into
Conversation
Shows 4 concrete scenarios: vague prompt clarification, multi-step scoping, correction pattern matching, and cross-service awareness. Each example includes the prompt, triage classification, and the actual output users can expect.
The README and examples/README.md referenced examples/.preflight/ but the actual config files didn't exist. Added: - config.yml — profile, related projects, thresholds, embeddings - triage.yml — keyword rules and strictness settings - contracts/api.yml — manual contract definition examples All files are heavily commented so users can copy them into their project root and customize without needing to reference the docs.
buildWhereFilter was interpolating user-supplied values (project, branch, etc.) directly into WHERE clauses without escaping single quotes. This would break queries when paths or branch names contain apostrophes. searchExact already escaped quotes — this brings buildWhereFilter in line. Also adds 9 unit tests for lib/files.ts (readIfExists + findWorkspaceDocs).
TerminalGravity
left a comment
TerminalGravity
left a comment
There was a problem hiding this comment.
Nice catch — the single-quote escaping in buildWhereFilter was a real injection vector. The escapeValue helper is clean and the doubling approach ('') is the standard SQL escape.
One thought: if we ever pass user-controlled values into these filters (e.g. from MCP tool args), we might want to consider parameterized queries down the line instead of string escaping. But for now this is solid and the files.test.ts coverage is a good addition. Ready to merge.
TerminalGravity
left a comment
TerminalGravity
left a comment
There was a problem hiding this comment.
Good catch on the SQL injection surface. Single quotes in branch names happen more than you'd think. Fix is consistent with what searchExact already does. files.ts tests are welcome — the binary rejection edge case is easy to miss.
TerminalGravity
left a comment
TerminalGravity
left a comment
There was a problem hiding this comment.
Reviewed — good catch on the SQL escape. The escapeValue helper is clean. One thought: might be worth adding a test that exercises the single-quote-in-project-name path specifically in a WHERE filter (the files.test.ts additions look solid but I didn't see that case covered). Otherwise ready to merge.
1 participant
What
Bug fix:
buildWhereFilterintimeline-db.tsinterpolated user-supplied values directly into WHERE clauses without escaping single quotes. Project paths or branch names with apostrophes would break queries.searchExactalready escaped them — this bringsbuildWhereFilterin line.Tests: 9 new unit tests for
lib/files.tscoveringreadIfExists(missing files, text read, maxLines truncation, binary rejection) andfindWorkspaceDocs(missing .claude dir, markdown discovery, nested dirs, skip node_modules/preflight-state, metadataOnly).All 52 tests pass. Clean build.