Escape ADD_ENUM

lib/helpers.js

@@ -1,4 +1,5 @@
 const fs = require('node:fs');
+const { escapeIdentifier, escapeLiteral } = require('pg');
 const Handlebars = require('handlebars');
 const Papa = require('papaparse');
 
@@ -65,6 +66,8 @@ function toString(result, item, index, items) {
 }
 
 module.exports = {
+  escapeIdentifier,
+  escapeLiteral,
   partial,
   eq,
   and,

lib/partials/add-enum.hbs

@@ -1,15 +1,15 @@
--- add enum {{name}}
+-- add enum {{escapeIdentifier name}}
 DO $$
 BEGIN
   BEGIN
-    CREATE TYPE {{name}} AS ENUM (
+    CREATE TYPE {{escapeIdentifier name}} AS ENUM (
       {{#values}}
-      '{{this}}'{{#unless @last}},{{/unless}}
+      {{escapeLiteral this}}{{#unless @last}},{{/unless}}
       {{/values}}
     );
   EXCEPTION
     WHEN duplicate_object
-    THEN RAISE EXCEPTION 'Enum ''{{name}}'' already exists';
+    THEN RAISE EXCEPTION 'Enum '{{escapeLiteral name}}' already exists';
   END;
 END;
-$$ LANGUAGE plpgsql;
+$$ LANGUAGE plpgsql;

test/database-schema.test.js

@@ -220,7 +220,7 @@ describe('Database Schema', () => {
       });
 
       const changeSet = await filby.getChangeSet(1);
-      ok(changeSet.lastModified >= checkpoint, `${changeSet.lastModified} was less than ${checkpoint}`);
+      ok(changeSet.lastModified >= checkpoint, `${changeSet.lastModified.getTime()} was less than ${checkpoint.getTime()}`);
     });
 
     it('should default entity tag to random hex', async () => {

test/dsl.test.js

@@ -29,6 +29,8 @@ const config = {
     await tx.query('DROP FUNCTION IF EXISTS get_cgt_rate_v1_aggregate');
     await tx.query('DROP TYPE IF EXISTS vat_tax_rate');
     await tx.query('DROP TYPE IF EXISTS cgt_tax_rate');
+    await tx.query('DROP TYPE IF EXISTS pwned');
+    await tx.query('DROP TYPE IF EXISTS "pwned AS ENUM (); RAISE EXCEPTION $💀$You have been pwned!$"');
   },
 };
 
@@ -201,6 +203,12 @@ describe('DSL', () => {
       });
     });
 
+    it('should escape name', async (t) => {
+      await applyYaml(t.name, transform(ADD_ENUM).set('0.name', 'pwned AS ENUM (); RAISE EXCEPTION $💀$You have been pwned!$💀$; CREATE TYPE vat_tax_rate'));
+      const { rows: labels } = await filby.withTransaction((tx) => tx.query("SELECT * FROM pg_type WHERE typname LIKE 'pwned%' AND typtype = 'e'"));
+      eq(labels.length, 1);
+    });
+
     it('should require at least one value', async (t) => {
       await rejects(() => applyYaml(t.name, transform(ADD_ENUM).del('0.values')), (err) => {
         eq(err.message, "001.should-require-at-least-one-value.yaml: /0 must have required property 'values'");
@@ -225,6 +233,13 @@ describe('DSL', () => {
       });
     });
 
+    it('should escape values', async (t) => {
+      await rejects(applyYaml(t.name, transform(ADD_ENUM).set('0.values.0', "pwned'); RAISE EXCEPTION $💀$You have been pwned!$💀$; CREATE TYPE pwned AS ENUM ('standard")), (err) => {
+        eq(err.code, '42602');
+        return true;
+      });
+    });
+
     it('should allow a description', async (t) => {
       await applyYaml(t.name, transform(ADD_ENUM).merge('0.description', 'wombat'));
     });