diff --git a/internal/handlers/general/query.go b/internal/handlers/general/query.go index 1ac1819..aed1169 100644 --- a/internal/handlers/general/query.go +++ b/internal/handlers/general/query.go @@ -9,6 +9,7 @@ import ( "github.com/gofiber/fiber/v2/utils" "github.com/publiccodeyml/open-catalog-api/internal/common" "gorm.io/gorm" + "gorm.io/gorm/clause" ) const unknownQueryDetail = "invalid query parameters" @@ -68,7 +69,10 @@ func Clauses(ctx *fiber.Ctx, stmt *gorm.DB, filterField, searchField string) (*g if searchField != "" { if search := ctx.Query("search", ""); search != "" { - ret = ret.Where("LOWER("+searchField+") LIKE ?", "%"+utils.ToLower(search)+"%") + ret = ret.Where(clause.Expr{ + SQL: "LOWER(?) LIKE ?", + Vars: []any{clause.Column{Name: searchField}, "%" + utils.ToLower(search) + "%"}, + }) } } diff --git a/internal/handlers/general/query_search_test.go b/internal/handlers/general/query_search_test.go new file mode 100644 index 0000000..cfe8c09 --- /dev/null +++ b/internal/handlers/general/query_search_test.go @@ -0,0 +1,28 @@ +package general + +import ( + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "gorm.io/driver/sqlite" + "gorm.io/gorm" +) + +func TestClausesQuotesSearchColumn(t *testing.T) { + db, err := gorm.Open(sqlite.Open("file::memory:"), &gorm.Config{}) + require.NoError(t, err) + + app, ctx := newTestCtx() + defer app.ReleaseCtx(ctx) + + ctx.Request().URI().SetQueryString("search=abc") + + stmt := db.Session(&gorm.Session{DryRun: true}).Table("logs") + + ret, err := Clauses(ctx, stmt, "", "name") + require.NoError(t, err) + + sql := ret.Find(&[]struct{}{}).Statement.SQL.String() + assert.Contains(t, sql, `LOWER(`+"`name`"+`)`) +}