ResolveSpec

mirror of https://github.com/bitechdev/ResolveSpec.git synced 2026-10-02 03:22:09 +00:00

Files

T

Hein ca89cb8a73 fix(common): harden CORS, sort, raw-SQL WHERE and x-custom-sql-or

Add a `hardening` config section (RESOLVESPEC_HARDENING_*) so each
fix can be switched off to restore the previous behaviour:

- cors_strict_origins: only reflect origins listed in
  cors.allowed_origins / server URLs, with credentials; `*` never
  sends credentials; fix shared-slice append of expose headers.
- sort_strict: join aliases must match `alias.identifier` (empty alias
  no longer matches everything); sort expressions reject dangerous
  functions/catalogs; cql* columns must be identifier-safe.
- sql_strict: client raw-SQL fragments must have balanced parens and
  quotes, no comments/`;`/`$$`, DML keywords, dangerous functions or
  system catalogs; a rejected fragment now fails closed ("(1=0)")
  instead of dropping the filter. Subqueries stay allowed unless
  sql_block_subqueries is set.
- x-custom-sql-or is grouped together with the client's own
  conditions (new optional WhereGrouper, implemented for bun and gorm)
  so it can no longer OR past server-side filters.

2026-10-01 13:46:01 +02:00

alias_test.go

Better tests

2025-12-09 15:32:16 +02:00

bun_columnexpr_test.go

fix(bun): spread variadic args correctly in ColumnExpr

2026-09-28 12:01:38 +02:00

bun_insert_test.go

INSERT statements were failing with duplicate key errors because the SQL being generated

2025-11-20 10:31:25 +02:00

bun.go

fix(common): harden CORS, sort, raw-SQL WHERE and x-custom-sql-or