Skip to content

Commit ccfe94e

Browse files
committed
adding safeguard preventing injection of WKT strings
- WKT geometry in the CQL2-text is not supposed to quoted as a string - Postgres tries to cast WKT string to an incorrect geometry type which consequently leads to a confusing error.
1 parent 9a97242 commit ccfe94e

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

src/stac_fastapi_pgstac_pair_search/sql/pair_search_alt.sql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -834,7 +834,7 @@ $$ LANGUAGE PLPGSQL; -- STABLE;
834834

835835
-- handle spatial operators
836836
CREATE OR REPLACE FUNCTION _spatial_operators(
837-
IN query jsonb,
837+
query jsonb,
838838
prefixes text[] DEFAULT NULL
839839
) RETURNS text AS $$
840840
DECLARE
@@ -896,6 +896,8 @@ BEGIN
896896
RETURN format('%L::geometry', bbox_geom(query->'bbox')::text);
897897
ELSIF jsonb_typeof(query) = 'array' THEN
898898
RETURN format('%L::geometry', bbox_geom(query)::text);
899+
ELSIF jsonb_typeof(query) IN ('string', 'number') THEN
900+
RAISE EXCEPTION 'A % literal is not allowed as an argument of spatial operator.', jsonb_typeof(query);
899901
END IF;
900902

901903
IF query ? 'op' AND query ? 'args' THEN

0 commit comments

Comments
 (0)