Skip to content

fix(webapp): escape single quotes in realtime tags filter#4296

Closed
ANSHSINGH050404 wants to merge 1 commit into
triggerdotdev:mainfrom
ANSHSINGH050404:fix/realtime-tags-sql-escape
Closed

fix(webapp): escape single quotes in realtime tags filter#4296
ANSHSINGH050404 wants to merge 1 commit into
triggerdotdev:mainfrom
ANSHSINGH050404:fix/realtime-tags-sql-escape

Conversation

@ANSHSINGH050404

@ANSHSINGH050404 ANSHSINGH050404 commented Jul 20, 2026

Copy link
Copy Markdown

Closes #3739

Checklist

  • Followed CONTRIBUTING.md
  • Single issue PR
  • Changeset / server-changes when required

Summary

Realtime tags were interpolated into an Electric WHERE ARRAY literal without escaping.

Fix

Escape ' as '' in each tag before building the clause.

Vouch request: #4290

@changeset-bot

changeset-bot Bot commented Jul 20, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: d026b81

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Hi @ANSHSINGH050404, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details.

@github-actions github-actions Bot closed this Jul 20, 2026
devin-ai-integration[bot]
devin-ai-integration Bot reviewed Jul 20, 2026
View reviewed changes

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Open in Devin Review

@coderabbitai

coderabbitai Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ec2d8524-ae6e-4f53-9bd2-26b17a801ce3

📥 Commits

Reviewing files that changed from the base of the PR and between a7c734c and d026b81.

📒 Files selected for processing (2)
  • .server-changes/fix-realtime-tags-sql-escape.md
  • apps/webapp/app/services/realtimeClient.server.ts

Walkthrough

Updated RealtimeClient.streamRuns to escape single quotes in provided tags before constructing the Electric realtime query’s runTags filter. Added a server change note documenting the fix.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@ANSHSINGH050404 ANSHSINGH050404 mentioned this pull request Jul 20, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@devin-ai-integration devin-ai-integration[bot] devin-ai-integration[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Security/Medium]: SQL injection in realtime API via unescaped tags parameter

1 participant

@ANSHSINGH050404