ReviewOS

stacks/bun-query-builder

whereLike/whereILike family loses its bound param on rebuild and mismatches placeholders

#1028
Closed glennmichael123 opened this 22 days ago · 0 comments
22 days ago

Summary

The LIKE/ILIKE helpers (whereLike, whereILike, whereNotLike, whereNotILike, and or* variants) set built = sql\...${pattern}`(param bound only inside the tagged template) AND separately calladdWhereText(..., 'LIKE ?')which pushes no param towhereParams. As soon as a later call sets built = null(e.g. a chained.where({...})), ensureBuilt()rebuilds fromtext+whereParamsand the pattern is silently dropped; the?/$n` placeholders no longer line up.

Evidence (repro)

selectFrom('users').whereILike('name','a%').where({age:5}).toSQL()
-> WHERE name ILIKE ? AND age = $1   (whereParams = [5]; 'a%' lost; ?/$1 mixed)

Location

src/client.ts:~3875-3945.

Suggested fix

Push the pattern into whereParams and emit a real getPlaceholder(idx) (like whereDate/whereAny); drop the parallel built = sql\...`` representation.

Severity: high. Found via internal code audit.

Sign in to comment on this issue.