DT-66: Implementation of table data fetching and filtering by abdotop · Pull Request #67 · 01-edu/devtools

abdotop · 2025-10-08T08:18:01Z

No description provided.

…th filtering and sorting

Copilot

Pull Request Overview

This PR implements table data fetching and filtering functionality for database deployments. It adds a new API endpoint to query table data with support for filtering, sorting, pagination, and search capabilities.

Adds a new fetchTablesData function with query construction utilities for WHERE and ORDER BY clauses
Creates a new POST endpoint /api/deployment/table/data for retrieving filtered table data
Implements SQL injection protection through basic string escaping

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
api/sql.ts	Adds core table data fetching logic with query construction functions
api/routes.ts	Implements new API endpoint with input validation and schema verification

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-08T08:19:03Z

api/sql.ts

+      const safeValue = value.replace(/'/g, "''")
+      whereClauses.push(`${key} ${comparator} '${safeValue}'`)


This basic string escaping approach is insufficient for SQL injection protection. Consider using parameterized queries or a proper SQL escaping library instead of manual quote replacement.

Copilot · 2025-10-08T08:19:03Z

api/sql.ts

+  }
+  if (params.search) {
+    const searchClauses = Array.from(columnsMap.values()).map((col) => {
+      return `${col.name} LIKE '%${params.search.replace(/'/g, "''")}%'`


The search functionality uses the same vulnerable string escaping approach. This could allow SQL injection through the search parameter.

Copilot · 2025-10-08T08:19:03Z

api/routes.ts

+  'POST/api/deployment/table/data': route({
+    fn: (_, { deployment, table, ...input }) => {
+      const depData = DeploymentsCollection.get(deployment)
+      if (!deployment) {


The condition checks !deployment but should check !depData since deployment is the input parameter and depData is the result from the collection lookup.

Suggested change

if (!deployment) {

if (!depData) {

Copilot · 2025-10-08T08:19:04Z

api/sql.ts

+    limitOffsetClause += `LIMIT ${params.limit} `
+
+    if (params.offset && parseInt(params.offset) >= 0) {
+      limitOffsetClause += `OFFSET ${params.offset} `


Direct string interpolation of limit and offset values without validation could allow SQL injection. Although parseInt is used for validation, the original string values are interpolated into the query.

Suggested change

limitOffsetClause += `LIMIT ${params.limit} `

if (params.offset && parseInt(params.offset) >= 0) {

limitOffsetClause += `OFFSET ${params.offset} `

const limit = parseInt(params.limit, 10)

limitOffsetClause += `LIMIT ${limit} `

if (params.offset && parseInt(params.offset) >= 0) {

const offset = parseInt(params.offset, 10)

limitOffsetClause += `OFFSET ${offset} `

Copilot

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-08T10:11:06Z

api/sql.ts

+  const query =
+    `SELECT * FROM ${params.table} ${whereClause} ${orderByClause} ${limitOffsetClause}`
+      .trim()


The table name is directly interpolated into the SQL query without validation or escaping. This could allow SQL injection if the table parameter is not properly validated upstream.

Copilot · 2025-10-08T10:11:07Z

api/routes.ts

+      limit: STR('The maximum number of rows to return'),
+      offset: STR('The number of rows to skip'),


The limit and offset parameters should be defined as numbers (NUM) rather than strings (STR) since they represent numeric values and are parsed as integers in the implementation.

Suggested change

limit: STR('The maximum number of rows to return'),

offset: STR('The number of rows to skip'),

limit: NUM('The maximum number of rows to return'),

offset: NUM('The number of rows to skip'),

kigiri · 2025-10-10T10:01:33Z

api/routes.ts

+      const columnsMap = new Map(
+        tableDef.columns.map((col) => [col.name, col]),
+      )
+


// could prepare the data once to only do this in the route: const columnsMap = formattedSchema[deployement]?.[table]

kigiri · 2025-10-10T10:02:08Z

api/sql.ts

+      const { key, comparator, value } = filter
+      const column = columnsMap.get(key)
+      if (!column) {
+        throw new Error(`Invalid filter column: ${key}`)


no need for new for basic Error

kigiri · 2025-10-10T10:02:49Z

api/sql.ts

+    }
+  }
+  if (params.search) {
+    const searchClauses = Array.from(columnsMap.values()).map((col) => {


instead of Array.from(columnsMap.values()).map(...)
do columnsMap.values().map(...).toArray()

kigiri · 2025-10-10T10:04:06Z

api/sql.ts

+  const orderByClause = constructOrderByClause(params, columnsMap)
+
+  let limitOffsetClause = ''
+  const limit = parseInt(params.limit, 10)


use Math.floor(Number(params.limit))

… of github.com:01-edu/devtools into 66-implementation-of-table-data-fetching-and-filtering

…chTablesData to use it

* feat(routes): change endpoint from GET to POST for deployment table data retrieval feat(Filtre): export parseFilters and parseSort functions for external use feat(DeploymentPage): integrate filter and sort functionality for deployment table data * feat(DeploymentPage): refactor data fetching and improve table display logic * feat(DeploymentPage): refactor layout and improve component structure * fix(DeploymentPage): correct parameter name from tq to qt for search functionality

abdotop added 5 commits October 7, 2025 10:41

feat(routes): add new endpoint for retrieving deployment table data

e3e823e

docs(routes): add comment for deployments in route definitions

c3b38eb

feat(routes): add new endpoint for retrieving deployment table data

f9fb32d

docs(routes): add comment for deployments in route definitions

ca2a0a3

feat(routes): add POST endpoint for fetching deployment table data wi…

b9e2783

…th filtering and sorting

abdotop requested a review from Copilot October 8, 2025 08:18

abdotop self-assigned this Oct 8, 2025

abdotop added the tournament Pull requests that are related to the Tournament team label Oct 8, 2025

abdotop linked an issue Oct 8, 2025 that may be closed by this pull request

Implementation of Table data fetching and filtering #66

Closed

Copilot AI reviewed Oct 8, 2025

View reviewed changes

abdotop force-pushed the 66-implementation-of-table-data-fetching-and-filtering branch 7 times, most recently from 99f9f43 to 51805fb Compare October 8, 2025 10:08

abdotop requested a review from Copilot October 8, 2025 10:10

Copilot AI reviewed Oct 8, 2025

View reviewed changes

kigiri reviewed Oct 10, 2025

View reviewed changes

abdotop force-pushed the 66-implementation-of-table-data-fetching-and-filtering branch from 51805fb to 3b86820 Compare October 13, 2025 09:42

Merge branch '66-implementation-of-table-data-fetching-and-filtering'…

1dc16e2

… of github.com:01-edu/devtools into 66-implementation-of-table-data-fetching-and-filtering

abdotop force-pushed the 66-implementation-of-table-data-fetching-and-filtering branch from 3b86820 to 1dc16e2 Compare October 14, 2025 09:34

abdotop added 2 commits October 17, 2025 08:07

feat(schema, sql): add columnsMap to DatabaseSchemaDef and update fet…

6f5bd66

…chTablesData to use it

abdotop marked this pull request as ready for review October 21, 2025 11:59

abdotop merged commit 7759dbc into master Oct 21, 2025
1 check passed

abdotop deleted the 66-implementation-of-table-data-fetching-and-filtering branch October 21, 2025 11:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DT-66: Implementation of table data fetching and filtering#67

DT-66: Implementation of table data fetching and filtering#67
abdotop merged 8 commits intomasterfrom
66-implementation-of-table-data-fetching-and-filtering

abdotop commented Oct 8, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 8, 2025

Uh oh!

Copilot AI Oct 8, 2025

Uh oh!

Copilot AI Oct 8, 2025

Uh oh!

Copilot AI Oct 8, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 8, 2025

Uh oh!

Copilot AI Oct 8, 2025

Uh oh!

kigiri Oct 10, 2025

Uh oh!

kigiri Oct 10, 2025

Uh oh!

kigiri Oct 10, 2025

Uh oh!

kigiri Oct 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		const safeValue = value.replace(/'/g, "''")
		whereClauses.push(`${key} ${comparator} '${safeValue}'`)

		limit: STR('The maximum number of rows to return'),
		offset: STR('The number of rows to skip'),

Conversation

abdotop commented Oct 8, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

kigiri Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

kigiri Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

kigiri Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

kigiri Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants