diff --git a/CHANGELOG.md b/CHANGELOG.md index fc823a755..b1a09526f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ # CHANGELOG.md ## v0.47.0 (unreleased) +- Updated sqlx-oldapi to v0.6.57 to fix SQL Server fallback expressions such as `ISNULL($missing, 'default')` truncating defaults or failing for date values when the bound variable is `NULL`. - Fixed MSSQL `JSON_OBJECT('key': value)` expressions being rejected by SQLPage's parser, including when used in `SET` statements or nested in `sqlpage.*` function calls. - OIDC now checks both normalized request paths and their resolved SQL files against protected prefixes, closing authentication bypasses through path and clean-URL aliases. Nonce verification also rejects provider-returned Argon2 parameters outside SQLPage's fixed low-cost profile before hashing. - `cargo install sqlpage`, and any build from the crates.io tarball, no longer needs internet access. The browser libraries now come from npm and ship inside the published crate. Building from a git checkout needs `npm ci` first. Pre-built binaries and the Docker image are unaffected. diff --git a/Cargo.lock b/Cargo.lock index ba088d137..22edbbf63 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4606,9 +4606,9 @@ dependencies = [ [[package]] name = "sqlx-core-oldapi" -version = "0.6.56" +version = "0.6.57" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e33eb18d1e750df8aef99361ee02e170562dff119108680bc9035e796cd2a84" +checksum = "a9cf228e0312c68be3bf5fe175305e28127a18a2d5231d1ed51888bfbbcfa8e9" dependencies = [ "ahash", "atoi 2.0.0", @@ -4669,9 +4669,9 @@ dependencies = [ [[package]] name = "sqlx-rt-oldapi" -version = "0.6.56" +version = "0.6.57" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b8d629fed8792460ff39bb58cb154bfe181893ab9a51d0a3634950b35672a57" +checksum = "ef74464ebe407e3e2a81013ede45cb60ebb3e5fe23f771bd68e3d1941558d542" dependencies = [ "once_cell", "tokio", diff --git a/Cargo.toml b/Cargo.toml index c1864fa9b..7b29ee23c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -37,7 +37,7 @@ panic = "abort" codegen-units = 2 [dependencies] -sqlx = { package = "sqlx-core-oldapi", version = "0.6.56", default-features = false, features = [ +sqlx = { package = "sqlx-core-oldapi", version = "0.6.57", default-features = false, features = [ "any", "runtime-tokio-rustls", "migrate", diff --git a/tests/sql_test_files/data/database-specific/mssql/null_variable_fallback.sql b/tests/sql_test_files/data/database-specific/mssql/null_variable_fallback.sql new file mode 100644 index 000000000..a0d27034d --- /dev/null +++ b/tests/sql_test_files/data/database-specific/mssql/null_variable_fallback.sql @@ -0,0 +1,8 @@ +SELECT + CONCAT( + 'isnull=[', ISNULL($missing, 'hello'), + '] coalesce=[', COALESCE($missing, 'hello'), + '] len=', LEN(ISNULL($missing, 'hello')), + '; date_is_date=', ISDATE(ISNULL($missing_date, GETDATE())) + ) AS actual, + 'isnull=[hello] coalesce=[hello] len=5; date_is_date=1' AS expected;