Skip to content

Conversation

@d4mr
Copy link
Contributor

@d4mr d4mr commented Nov 6, 2024

PR-Codex overview

This PR focuses on changing the data type of chainId from Int to String across various models and functions, ensuring consistent handling of chainId as a string throughout the codebase.

Detailed summary

  • Updated chainId to String in ContractEventLogs, ContractTransactionReceipts, and ChainIndexers models.
  • Changed chainId handling to toString() in multiple queries and functions.
  • Parsed chainId as Number.parseInt() where necessary.
  • Modified SQL migration to alter chainId data type to TEXT.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

FROM
"chain_indexers"
WHERE
"chainId"=${chainId}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

needed to wrap ${chainId} in quotes to work for a SQL string comparison. Opted to use Prisma.sql which is the recommended way of templating in SQL string.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm why can't this line just be:

"chainId"="${chainId.toString()}"

Copy link
Contributor Author

@d4mr d4mr Nov 7, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah that works, and given that we know chainId is sanitised it should be fine, but just a standard best practice to not use raw string interpolation with SQL

Copy link
Contributor

@arcoraven arcoraven Nov 9, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets simplify it. From how I'm reading Prisma docs (source), Prisma handles the sql injection risk.

The method is implemented as a tagged template, which allows you to pass a template literal where you can easily insert your variables. In turn, Prisma Client creates prepared statements that are safe from SQL injections:

const email = 'emelie@prisma.io'
const result = await prisma.$queryRaw`SELECT * FROM User WHERE email = ${email}`

@d4mr d4mr requested a review from arcoraven November 8, 2024 07:54
@d4mr d4mr merged commit 0b784dc into main Nov 11, 2024
5 checks passed
@d4mr d4mr deleted the pb/all-chainIds-to-string branch November 11, 2024 08:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants