fix(security): accept only query-builder WHERE clauses

[farnabaz]

🔗 Linked issue

No public issue. Reported as an unauthenticated SQL injection against /__nuxt_content/:collection/query via a PostgreSQL escape-string mismatch in assertSafeQuery().

❓ Type of change

• 📖 Documentation (updates to the documentation or readme)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

assertSafeQuery() tried to allowlist WHERE clauses by stripping quotes and scanning what was left. That is not the same as the SQL collectionQueryBuilder emits.

singleQuote() only writes standard '…' literals, with '' as the only escape. The builder then wraps quoted fields and a fixed operator list (=, IN, LIKE, BETWEEN, IS NULL, and their NOT forms) in AND/OR groups. It never emits PostgreSQL E'…' / e'…' escape strings, U&'…' unicode strings, or $tag$…$tag$ dollar quotes.

The WHERE check now parses that builder grammar and rejects anything else. Values the builder would actually quote, including backslashes and the characters E', stay allowed. Bare numbers such as "id" = 1 are rejected; the builder always quotes them as '1'. queryCollection() output is unchanged.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
content	Ready	Preview	Oct 12, 2026 4:06am UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6b7fa51a-1172-4ad6-82a8-3b3034d916b8

---

📥 Commits

Reviewing files that changed from the base of the PR and between c256408 and 0ed65a9.

---

📒 Files selected for processing (2)

• src/runtime/internal/security.ts
• test/unit/assertSafeQuery.test.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

---

📝 Walkthrough

Walkthrough

assertSafeQuery now validates WHERE clauses against the query builder’s emitted grammar. The parser accepts supported identifiers, operators, quoted values, lists, pairs, and grouped expressions. Tests cover rejected bare numeric values and alternate string-escape forms, plus accepted backslashes and escaped apostrophes in single-quoted values.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

---

Merge Risk: ⚪ Minimal · up to 0ed65

The change tightens SQL WHERE validation to match the query builder's output grammar. No actionable merge-blocking risk was identified in the supplied context.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 18.18% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check		The description clearly explains the security issue and the grammar-parsing fix for assertSafeQuery().
Title check		The title concisely identifies the security fix and its main behavior: accepting only query-builder WHERE clauses.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

src/runtime/internal/security.ts

Parsing error: Unexpected token :

---

test/unit/assertSafeQuery.test.ts

Parsing error: Unexpected token as

---

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

npm i https://pkg.pr.new/@nuxt/content@3877

commit: 0ed65a9