Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
# CHANGELOG.md

## v0.47.0 (unreleased)
- Updated sqlx-oldapi to v0.6.57 to fix SQL Server fallback expressions such as `ISNULL($missing, 'default')` truncating defaults or failing for date values when the bound variable is `NULL`.
- Fixed MSSQL `JSON_OBJECT('key': value)` expressions being rejected by SQLPage's parser, including when used in `SET` statements or nested in `sqlpage.*` function calls.
- OIDC now checks both normalized request paths and their resolved SQL files against protected prefixes, closing authentication bypasses through path and clean-URL aliases. Nonce verification also rejects provider-returned Argon2 parameters outside SQLPage's fixed low-cost profile before hashing.
- `cargo install sqlpage`, and any build from the crates.io tarball, no longer needs internet access. The browser libraries now come from npm and ship inside the published crate. Building from a git checkout needs `npm ci` first. Pre-built binaries and the Docker image are unaffected.
Expand Down
8 changes: 4 additions & 4 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ panic = "abort"
codegen-units = 2

[dependencies]
sqlx = { package = "sqlx-core-oldapi", version = "0.6.56", default-features = false, features = [
sqlx = { package = "sqlx-core-oldapi", version = "0.6.57", default-features = false, features = [
"any",
"runtime-tokio-rustls",
"migrate",
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
SELECT
CONCAT(
'isnull=[', ISNULL($missing, 'hello'),
'] coalesce=[', COALESCE($missing, 'hello'),
'] len=', LEN(ISNULL($missing, 'hello')),
'; date_is_date=', ISDATE(ISNULL($missing_date, GETDATE()))
) AS actual,
'isnull=[hello] coalesce=[hello] len=5; date_is_date=1' AS expected;
Loading