From c941cd83fba359966134b013cd6f1c69bea94b70 Mon Sep 17 00:00:00 2001 From: Jon Seager Date: Mon, 2 Feb 2026 14:27:03 +0000 Subject: [PATCH] docs(bags): add SAFETY comment for SQL string interpolation Document why direct format!() interpolation is acceptable in build_where_clause(): the values are type-safe (bool outputs literal TRUE/FALSE, roast_id is i64 from typed wrapper). Warns future developers to use parameterized queries if string fields are added. --- src/infrastructure/repositories/bags.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/infrastructure/repositories/bags.rs b/src/infrastructure/repositories/bags.rs index ce5ff9e..f7ea1db 100644 --- a/src/infrastructure/repositories/bags.rs +++ b/src/infrastructure/repositories/bags.rs @@ -84,6 +84,10 @@ impl SqlBagRepository { fn build_where_clause(filter: &BagFilter) -> Option { let mut conditions = Vec::new(); + // SAFETY: Direct interpolation is safe here because: + // - `closed` is a bool, outputting literal "TRUE"/"FALSE" + // - `roast_id` is an i64 from a typed wrapper + // If adding string-based filters, use parameterized queries instead. if let Some(closed) = filter.closed { conditions.push(format!( "b.closed = {}",