fix: [#660] WhereBetween, etc. method can't support string correctly#1036
Merged
fix: [#660] WhereBetween, etc. method can't support string correctly#1036
Conversation
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR enhances security by parameterizing SQL in range-based query methods, boosts test coverage with date-based filters, and streamlines default test configuration.
- Query methods (
WhereBetween,WhereNotBetween,OrWhereBetween,OrWhereNotBetween) now use?placeholders. - Added tests for
created_atfiltering and time-based scenarios. - Switched default test model from
TestModelNormaltoTestModelMinimum.
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| support/docker/docker.go | Changed default TestModel to TestModelMinimum. |
| database/gorm/query.go | Updated range query methods to use parameterized SQL with ? placeholders. |
| database/gorm/query_test.go | Added created_at date-range tests and time.Sleep to simulate timing. |
Comments suppressed due to low confidence (2)
database/gorm/query_test.go:3423
- [nitpick] The variable name
users1is ambiguous; consider a more descriptive name such asfilteredUsersByDatefor clarity.
var users1 []User
database/gorm/query.go:995
- Consider quoting the column identifier (e.g., wrapping in backticks) to avoid SQL injection or reserved-word conflicts, e.g., fmt.Sprintf("
%sBETWEEN ? AND ?", column).
return r.Where(fmt.Sprintf("%s BETWEEN ? AND ?", column), x, y)
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## v1.15.x #1036 +/- ##
==========================================
Coverage ? 68.74%
==========================================
Files ? 218
Lines ? 18855
Branches ? 0
==========================================
Hits ? 12962
Misses ? 5231
Partials ? 662 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📑 Description
Closes goravel/goravel#660
This pull request includes updates to the
database/gormpackage to improve query handling and enhance test coverage, as well as a minor configuration change in thesupport/dockerpackage. The most important changes include modifying query methods to use parameterized SQL statements for improved security, adding test cases to validate these changes, and updating the default test model configuration.Query Handling Improvements:
WhereBetween,WhereNotBetween,OrWhereBetween, andOrWhereNotBetweenmethods inquery.goto use parameterized SQL statements (?placeholders) instead of directly embedding values in the query string for improved security and maintainability.Test Coverage Enhancements:
query_test.goto validate the behavior ofWhereBetween,WhereNotBetween,OrWhereBetween, andOrWhereNotBetweenmethods withcreated_atcolumn, ensuring correct results with date-based filtering. [1] [2] [3] [4]time.Sleepin tests to simulate time differences for more realistic date-based filtering scenarios. [1] [2] [3]Configuration Update:
docker.gofromTestModelNormaltoTestModelMinimum, likely to streamline testing or reduce resource usage during tests.✅ Checks