hasura · rikinsk-zz · Aug 9, 2019 · Aug 5, 2019 · Aug 5, 2019 · Aug 6, 2019
@@ -0,0 +1,9 @@
+export const sqlEscapeText = text => {
+  let _text = text;
+
+  if (_text) {
+    _text = _text.replace(/'/g, "\\'");
+  }
+
+  return `E'${_text}'`;
+};
@@ -226,7 +226,7 @@ class ApiRequest extends Component {
     };
 
     const getHeaderTable = () => {
-      const { headersSectionIsOpen } = this.state;
+      const { headersSectionIsOpen, adminSecretVisible } = this.state;
       const getHeaderRows = () => {
         const headers = this.props.headers;
 
@@ -259,6 +259,9 @@ class ApiRequest extends Component {
         };
 
         return headers.map((header, i) => {
+          const isAdminSecret =
+            header.key.toLowerCase() === `x-hasura-${globals.adminSecretLabel}`;
+
           const getHeaderActiveCheckBox = () => {
             let headerActiveCheckbox = null;
 
@@ -338,11 +341,7 @@ class ApiRequest extends Component {
             }
 
             let type = 'text';
-            if (
-              header.key.toLowerCase() ===
-                `x-hasura-${globals.adminSecretLabel}` &&
-              !this.state.adminSecretVisible
-            ) {
+            if (isAdminSecret && !adminSecretVisible) {
               type = 'password';
             }
 
@@ -368,10 +367,7 @@ class ApiRequest extends Component {
           const getHeaderAdminVal = () => {
             let headerAdminVal = null;
 
-            if (
-              header.key.toLowerCase() ===
-              `x-hasura-${globals.adminSecretLabel}`
-            ) {
+            if (isAdminSecret) {
               headerAdminVal = (
                 <i
                   className={styles.showAdminSecret + ' fa fa-eye'}
@@ -617,8 +613,8 @@ class ApiRequest extends Component {
             claimData =
               claimFormat === 'stringified_json'
                 ? generateValidNameSpaceData(
-                  JSON.parse(payload[claimNameSpace])
-                )
+                    JSON.parse(payload[claimNameSpace])
+                  )
                 : generateValidNameSpaceData(payload[claimNameSpace]);
           } catch (e) {
             console.error(e);

@@ -10,6 +10,7 @@ import { UPDATE_MIGRATION_STATUS_ERROR } from '../../../Main/Actions';
 import { setTable } from '../DataActions.js';
 
 import { isPostgresFunction } from '../utils';
+import { sqlEscapeText } from '../../../Common/utils/sqlUtils';
 
 const SET_DEFAULTS = 'AddTable/SET_DEFAULTS';
 const SET_TABLENAME = 'AddTable/SET_TABLENAME';
@@ -294,9 +295,8 @@ const createTableSql = () => {
         tableName +
         '"' +
         ' IS ' +
-        "'" +
-        state.tableComment +
-        "';";
+        sqlEscapeText(state.tableComment) +
+        ';';
     }
 
     if (columnSpecificSql.length) {

@@ -27,6 +27,7 @@ import {
 } from '../Common/ReusableComponents/utils';
 
 import { isPostgresFunction } from '../utils';
+import { sqlEscapeText } from '../../../Common/utils/sqlUtils';
 
 import {
   fetchColumnCastsQuery,
@@ -589,7 +590,7 @@ FOR EACH ${trigger.action_orientation} ${trigger.action_statement};`;
 
     if (trigger.comment) {
       downMigrationSql += `COMMENT ON TRIGGER "${triggerName}" ON "${tableSchema}"."${tableName}" 
-IS '${trigger.comment}';`;
+IS ${sqlEscapeText(trigger.comment)};`;
     }
     const migrationDown = [
       {
@@ -1020,9 +1021,7 @@ const deleteColumnSql = (column, tableSchema) => {
             '"' +
             ' ' +
             'IS ' +
-            "'" +
-            comment +
-            "'",
+            sqlEscapeText(comment),
         },
       });
     }
@@ -1300,7 +1299,7 @@ const saveTableCommentSql = isTable => {
     const commentUpQuery =
       updatedComment === ''
         ? commentQueryBase + 'NULL'
-        : commentQueryBase + "'" + updatedComment + "'";
+        : commentQueryBase + sqlEscapeText(updatedComment);
 
     const commentDownQuery = commentQueryBase + 'NULL';
     const schemaChangesUp = [
@@ -1838,9 +1837,8 @@ const saveColumnChangesSql = (colName, column, onSuccess) => {
       colName +
       '"' +
       ' IS ' +
-      "'" +
-      comment +
-      "'";
+      sqlEscapeText(comment);
+
     const columnCommentDownQuery =
       'COMMENT ON COLUMN ' +
       '"' +
@@ -1855,9 +1853,7 @@ const saveColumnChangesSql = (colName, column, onSuccess) => {
       colName +
       '"' +
       ' IS ' +
-      "'" +
-      originalColComment +
-      "'";
+      sqlEscapeText(originalColComment);
 
     // check if comment is unchanged and then do an update. if not skip
     if (originalColComment !== comment.trim()) {

@@ -210,7 +210,11 @@ export const dropInconsistentObjects = () => {
         console.error(error);
         dispatch({ type: DROPPING_INCONSISTENT_METADATA_FAILED });
         dispatch(
-          showErrorNotification('Dropping inconsistent metadata failed')
+          showErrorNotification(
+            'Dropping inconsistent metadata failed',
+            null,
+            error
+          )
         );
       }
     );
@@ -531,7 +535,7 @@ export const metadataReducer = (state = defaultState, action) => {
         ...state,
         allowedQueries: [
           ...state.allowedQueries.map(q =>
-            (q.name === action.data.queryName ? action.data.newQuery : q)
+            q.name === action.data.queryName ? action.data.newQuery : q
           ),
         ],
       };