sql should never be literal strings but instead use a proper abstraction #1

Closed
opened 2026-07-15 07:49:42 +00:00 by hugo · 1 comment
Owner

bring in a proper orm and proper migration library instead of using literal sql strings, as that is too fragile and too prone to sql injection. There must not be literal SQL in the app, unless it is an absolute necessity due to limitations of the used abstraction layer.

bring in a proper orm and proper migration library instead of using literal sql strings, as that is too fragile and too prone to sql injection. There must not be literal SQL in the app, unless it is an absolute necessity due to limitations of the used abstraction layer.
hugo added the enhancement label 2026-07-15 07:50:17 +00:00
hugo changed title from gap: sql should never be literal strings but instead use a proper abstraction to sql should never be literal strings but instead use a proper abstraction 2026-07-15 07:51:51 +00:00
hugo added the bug label 2026-07-15 08:06:30 +00:00
Author
Owner

Implemented in ca5eb4e. Replaced application-level literal SQL and rusqlite/refinery with Diesel typed queries, generated schema, and embedded Diesel migrations. Raw SQL is limited to SQLite-specific FTS5, connection PRAGMAs/savepoints, and migration files; an ORM boundary test enforces this. Verified with cargo test --workspace -- --test-threads=1, cargo clippy --workspace --all-targets -- -D warnings, cargo fmt, Diesel migration redo/schema regeneration, and allium check specs/schema.allium.

Implemented in ca5eb4e. Replaced application-level literal SQL and rusqlite/refinery with Diesel typed queries, generated schema, and embedded Diesel migrations. Raw SQL is limited to SQLite-specific FTS5, connection PRAGMAs/savepoints, and migration files; an ORM boundary test enforces this. Verified with cargo test --workspace -- --test-threads=1, cargo clippy --workspace --all-targets -- -D warnings, cargo fmt, Diesel migration redo/schema regeneration, and allium check specs/schema.allium.
hugo closed this issue 2026-07-18 15:01:22 +00:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: hugo/RuDS#1