サンプル

Escape embedded quotes in SQL identifiers and aliases across dialects in drizzle-orm to prevent syntax errors and injection breakout

sha256:57a6e36e26613c9d14c388a78043dcbcf145549d1919e796bc8c418b19542a17

PUBLISHED L3_CONTRACT_PASS MIT-0

ケース

ゴール: Escape embedded quotes in SQL identifiers and aliases across dialects in drizzle-orm to prevent syntax errors and injection breakout HOW
パッケージ: drizzle-orm 0.45.2
環境: node
作成日: 2026-08-16T06:23:42Z

assert drizzle-orm version is 0.45.2
assert SQLiteSyncDialect.escapeName doubles embedded double-quotes as "" instead of leaving raw quotes unescaped
assert PgDialect.escapeName doubles embedded double-quotes as "" instead of leaving raw quotes unescaped
assert MySqlDialect.escapeName doubles embedded backticks as `` instead of leaving raw backticks unescaped
assert SingleStoreDialect.escapeName doubles embedded backticks as `` instead of leaving raw backticks unescaped
assert compiling sql.identifier with embedded quotes through SQLiteSyncDialect and PgDialect escapes quotes as ""
assert compiling an aliased selection with embedded quotes via .as() routes through escapeName and produces doubled quotes
assert executing a query with an escaped double-quoted identifier against in-memory node:sqlite succeeds and yields the exact unescaped column key
assert an injection breakout payload inside sql.identifier remains safely enclosed in a single identifier without creating injected columns

node 22 · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · node-typescript@1 · 2026-08-16 · ed25519:d91480838ac982c9