-
Notifications
You must be signed in to change notification settings - Fork 105
refactor all int chainId to string #762
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
| FROM | ||
| "chain_indexers" | ||
| WHERE | ||
| "chainId"=${chainId} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
needed to wrap ${chainId} in quotes to work for a SQL string comparison. Opted to use Prisma.sql which is the recommended way of templating in SQL string.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hm why can't this line just be:
"chainId"="${chainId.toString()}"
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yeah that works, and given that we know chainId is sanitised it should be fine, but just a standard best practice to not use raw string interpolation with SQL
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Lets simplify it. From how I'm reading Prisma docs (source), Prisma handles the sql injection risk.
The method is implemented as a tagged template, which allows you to pass a template literal where you can easily insert your variables. In turn, Prisma Client creates prepared statements that are safe from SQL injections:
const email = 'emelie@prisma.io'
const result = await prisma.$queryRaw`SELECT * FROM User WHERE email = ${email}`
PR-Codex overview
This PR focuses on changing the data type of
chainIdfromInttoStringacross various models and functions, ensuring consistent handling ofchainIdas a string throughout the codebase.Detailed summary
chainIdtoStringinContractEventLogs,ContractTransactionReceipts, andChainIndexersmodels.chainIdhandling totoString()in multiple queries and functions.chainIdasNumber.parseInt()where necessary.chainIddata type toTEXT.