Repository navigation
fix(query): allow digits in ORDER BY column names - #3894
Conversation
|
@PerryLink is attempting to deploy a commit to the Nuxt Team on Vercel. A member of the Team first needs to authorize it. |
commit: |
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title "fix(query): allow digits in ORDER BY column names" matches the main change. The diff widens the ORDER BY column-name pattern in assertSafeQuery so that digits are allowed after the first ch… |
| Description check | |
The description explains the bug, the root cause (the ORDER BY regex rejects digits while the SELECT checks accept them), and the one-line regex change. It also lists the added test cases and the test… |
| Linked Issues check | |
[#3893] Directly linked issue #3893 requires that ORDER BY on schema fields containing digits (for example publishedAt2 and h1) passes the server-side assertSafeQuery() validator. The whole-PR d… |
| Out of Scope Changes check | |
The whole-PR diff touches only src/runtime/internal/security.ts (one ORDER BY regex line) and test/unit/assertSafeQuery.test.ts (added test cases for digit-containing ORDER BY column names and ret… |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. |
Full details: Title check
-
Explanation
The title "fix(query): allow digits in ORDER BY column names" matches the main change. The diff widens the ORDER BY column-name pattern in assertSafeQuery so that digits are allowed after the first character. The title is concise, specific, and follows a conventional commit style.
Full details: Description check
-
Explanation
The description explains the bug, the root cause (the ORDER BY regex rejects digits while the SELECT checks accept them), and the one-line regex change. It also lists the added test cases and the test results. It relates directly to the changeset.
Full details: Linked Issues check
-
Explanation
[
#3893] Directly linked issue#3893requires that ORDER BY on schema fields containing digits (for examplepublishedAt2andh1) passes the server-sideassertSafeQuery()validator. The whole-PR diff (merge base 3942be4 to head e3895e7) changes one line insrc/runtime/internal/security.ts. The ORDER BY pattern changes from/^("[a-zA-Z_]+"|[a-zA-Z_]+) (ASC|DESC)$/to/^("[a-zA-Z_]\w*"|[a-zA-Z_]\w*) (ASC|DESC)$/. At head, the quoted form"publishedAt2" DESCand the unquoted formpublishedAt2 DESCboth match.h1 DESCalso matches. The new pattern still rejects names containing spaces, such as"a b" DESC. The ORDER BY check still runs after the existing SELECT, WHERE, and FROM checks, which are unchanged. The change adds unit test cases forORDER BY "field1" DESC,ORDER BY id ASC, publishedAt2 DESC, and rejection of"a b" DESC, as described in the PR. I did not run the test suite. The conclusion rests on the regex diff and the file content at head. No non-coding requirements are present in the linked issue.
Full details: Out of Scope Changes check
-
Explanation
The whole-PR diff touches only
src/runtime/internal/security.ts(one ORDER BY regex line) andtest/unit/assertSafeQuery.test.ts(added test cases for digit-containing ORDER BY column names and retained rejection of a quoted name with a space). Both changes support objective#3893directly. The change does not alter SELECT, WHERE, FROM, LIMIT, OFFSET, or comment-handling logic. No unrelated changes were found in the reviewed diff summary or the inspected source.
Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
nuxt/content#3894 merged at 12:44:39Z, after the 12:35:07Z derivation: 408 credited in 90, 441 across 92, 162 open across 124.
Resolves #3893
assertSafeQuery()validated ORDER BY column names with/^("[a-zA-Z_]+"|[a-zA-Z_]+) (ASC|DESC)$/, which rejects any schema field containing a digit, while the SELECT column checks at the top of the same function use/^"[a-z_]\w+"$/iand accept them. Server/SSR queries throughqueryCollection('docs').order('publishedAt2', 'DESC')therefore returned a 500 (Invalid query: ORDER BY clause must contain valid column names followed by ASC or DESC), even though.where('publishedAt2', ...)and.select('publishedAt2')worked and the client WASM path (which bypasses the validator) sorted correctly.Widen the ORDER BY pattern the same way #3100 widened it for uppercase names:
[a-zA-Z_]\w*so digits are allowed after the first character, matching whatcollectionQueryBuilderemits for arbitrary zod object keys.Tests
test/unit/assertSafeQuery.test.tsadds cases forORDER BY "field1" DESC,ORDER BY id ASC, publishedAt2 DESC, thecollectionQueryBuilderoutput for a digit field, and keepsORDER BY "a b" DESCrejected.test/unitsuite: 408 passed, 1 skipped; the only failing file is the pre-existingtest/unit/utils.test.ts(imports@nuxt/content/utilsfrom an unbuiltdist), which fails before this change too.