bring in a proper orm and proper migration library instead of using literal sql strings, as that is too fragile and too prone to sql injection. There must not be literal SQL in the app, unless it is an absolute necessity due to limitations of the used abstraction layer.
bring in a proper orm and proper migration library instead of using literal sql strings, as that is too fragile and too prone to sql injection. There must not be literal SQL in the app, unless it is an absolute necessity due to limitations of the used abstraction layer.
hugo
changed title from gap: sql should never be literal strings but instead use a proper abstraction to sql should never be literal strings but instead use a proper abstraction2026-07-15 07:51:51 +00:00
hugo
added the bug label 2026-07-15 08:06:30 +00:00
Implemented in ca5eb4e. Replaced application-level literal SQL and rusqlite/refinery with Diesel typed queries, generated schema, and embedded Diesel migrations. Raw SQL is limited to SQLite-specific FTS5, connection PRAGMAs/savepoints, and migration files; an ORM boundary test enforces this. Verified with cargo test --workspace -- --test-threads=1, cargo clippy --workspace --all-targets -- -D warnings, cargo fmt, Diesel migration redo/schema regeneration, and allium check specs/schema.allium.
Implemented in ca5eb4e. Replaced application-level literal SQL and rusqlite/refinery with Diesel typed queries, generated schema, and embedded Diesel migrations. Raw SQL is limited to SQLite-specific FTS5, connection PRAGMAs/savepoints, and migration files; an ORM boundary test enforces this. Verified with cargo test --workspace -- --test-threads=1, cargo clippy --workspace --all-targets -- -D warnings, cargo fmt, Diesel migration redo/schema regeneration, and allium check specs/schema.allium.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
bring in a proper orm and proper migration library instead of using literal sql strings, as that is too fragile and too prone to sql injection. There must not be literal SQL in the app, unless it is an absolute necessity due to limitations of the used abstraction layer.
gap: sql should never be literal strings but instead use a proper abstractionto sql should never be literal strings but instead use a proper abstractionImplemented in
ca5eb4e. Replaced application-level literal SQL and rusqlite/refinery with Diesel typed queries, generated schema, and embedded Diesel migrations. Raw SQL is limited to SQLite-specific FTS5, connection PRAGMAs/savepoints, and migration files; an ORM boundary test enforces this. Verified with cargo test --workspace -- --test-threads=1, cargo clippy --workspace --all-targets -- -D warnings, cargo fmt, Diesel migration redo/schema regeneration, and allium check specs/schema.allium.