ReviewOS

stacks/bun-query-builder

whereLike/whereILike family loses its bound param on rebuild and mismatches placeholders

#1028
Closed glennmichael123 opened this 2 months ago ·
2 months ago

Summary

The LIKE/ILIKE helpers (whereLike, whereILike, whereNotLike, whereNotILike, and or* variants) set built = sql\...${pattern}`(param bound only inside the tagged template) AND separately calladdWhereText(..., 'LIKE ?')which pushes no param towhereParams. As soon as a later call sets built = null(e.g. a chained.where({...})), ensureBuilt()rebuilds fromtext+whereParamsand the pattern is silently dropped; the?/$n` placeholders no longer line up.

Evidence (repro)

selectFrom('users').whereILike('name','a%').where({age:5}).toSQL()
-> WHERE name ILIKE ? AND age = $1   (whereParams = [5]; 'a%' lost; ?/$1 mixed)

Location

src/client.ts:~3875-3945.

Suggested fix

Push the pattern into whereParams and emit a real getPlaceholder(idx) (like whereDate/whereAny); drop the parallel built = sql\...`` representation.

Severity: high. Found via internal code audit.

9 days ago

Fixed in 256a074. All eight LIKE/ILIKE helpers now push their pattern into whereParams with a getPlaceholder()-based placeholder, so the text/whereParams shadow stays consistent with the built fast path — a following where() that invalidates built no longer rebuilds with the pattern dropped or placeholders mixed (ILIKE $1 AND age = $2, not ILIKE ? AND age = $1). Regression test added; full suite green.

Sign in to comment on this issue.