Repository navigation

fix(security): keep caller-named fields off internal columns and operators - #1054

Open

eldadfux wants to merge 10 commits into

mainfrom

fix/injection-hardening

Open

fix(security): keep caller-named fields off internal columns and operators#1054
eldadfux wants to merge 10 commits into
mainfrom
fix/injection-hardening

Commits on Nov 3, 2026
- fix(security): keep attribute names off the storage columns
  
  eldadfux
  and
  claude
  committed
  6fbb37f
- fix(mongo): match cursor values and $-named exists and elemMatch fields as data
  
  eldadfux
  and
  claude
  committed
  bf012d2
- fix(sqlite): find a collection's fulltext tables by their exact name
  
  eldadfux
  and
  claude
  committed
  37ad52a
- fix(security): enclose raw conditions so an OR stays within the tenant
  
  eldadfux
  and
  claude
  committed
  f75b6b9
Commits on Nov 4, 2026
- fix(mongo): keep $-named aliases of storage fields off every write
  
  abnegate
  and
  claude
  committed
  0a6c05d
- fix(sqlite): find a collection's fulltext tables among virtual tables only
  
  abnegate
  and
  claude
  committed
  649950a
- fix(validator): refuse storage-column keys with defined attributes too
  
  abnegate
  and
  claude
  committed
  83c70f9
- test(postgres): cover an OR in a raw filter staying enclosed
  
  abnegate
  and
  claude
  committed
  0bb758d
- fix(mongo): increase a $-named field where it is stored
  
  abnegate
  and
  claude
  committed
  bc509ee
- fix(sqlite): take only fts5 tables as a collection's fulltext index
  
  abnegate
  and
  claude
  committed
  48ac8b6