Skip to content

feat: allow Postgres JSON path syntax in isSafeColumn

chaiwat sae-jiw requested to merge feat/update-buildin-func into main

Extend the column-name whitelist to accept -> and ->> accessors so callers can search/filter/sort on JSONB fields (e.g. meta_data->>'plateNumber', sp.meta_data->'a'->>'b') without being silently dropped. Keys are restricted to single-quoted safe identifiers or non-negative integer indexes, so the column remains injection-safe when it carries through from a user-supplied query parameter.

Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com

Merge request reports