moby/brewlog
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(bags): add SAFETY comment for SQL string interpolation

Browse source 
Document why direct format!() interpolation is acceptable in
build_where_clause(): the values are type-safe (bool outputs literal
TRUE/FALSE, roast_id is i64 from typed wrapper). Warns future
developers to use parameterized queries if string fields are added.
This commit is contained in:
Jon Seager 2026-02-02 14:27:03 +00:00
parent 3a9fb16793
commit c941cd83fb
No known key found for this signature in database
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/infrastructure/repositories/bags.rs
View file

@ -84,6 +84,10 @@ impl SqlBagRepository {
fn build_where_clause(filter: &BagFilter) -> Option<String> { fn build_where_clause(filter: &BagFilter) -> Option<String> {
let mut conditions = Vec::new(); let mut conditions = Vec::new();
// SAFETY: Direct interpolation is safe here because:
// - `closed` is a bool, outputting literal "TRUE"/"FALSE"
// - `roast_id` is an i64 from a typed wrapper
// If adding string-based filters, use parameterized queries instead.
if let Some(closed) = filter.closed { if let Some(closed) = filter.closed {
conditions.push(format!( conditions.push(format!(
"b.closed = {}", "b.closed = {}",