From ff8361c461368a81dee40c0cea827dd760ca8b87 Mon Sep 17 00:00:00 2001 From: "dreadnode-renovate-bot[bot]" <184170622+dreadnode-renovate-bot[bot]@users.noreply.github.com> Date: Sun, 24 May 2026 00:34:14 +0000 Subject: [PATCH 1/2] chore(deps): update rust crate sqlx to 0.9 | datasource | package | from | to | | ---------- | ------- | ----- | ----- | | crate | sqlx | 0.8.6 | 0.9.0 | --- Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Cargo.toml b/Cargo.toml index 9aac95ec..9f1316ed 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -38,7 +38,7 @@ anyhow = "1" clap = { version = "4.5.23", features = ["derive", "env"] } serde_yaml = "0.9" regex = "1" -sqlx = { version = "0.8", features = ["runtime-tokio", "postgres", "chrono", "json", "uuid"] } +sqlx = { version = "0.9", features = ["runtime-tokio", "postgres", "chrono", "json", "uuid"] } tera = "2" hickory-resolver = { version = "0.26", default-features = false, features = ["tokio", "system-config"] } From 84726d6c300114da72c966b381631400674a8033 Mon Sep 17 00:00:00 2001 From: Jayson Grace Date: Sun, 26 Jul 2026 13:20:26 -0600 Subject: [PATCH 2/2] fix: mark dynamic sql queries as safe with sqlx::AssertSqlSafe MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Changed:** - Wrap dynamically built SQL strings with AssertSqlSafe when calling sqlx::query_as in CLI history modules (cost, list, search) to satisfy SQLx safety checks for runtime-built queries and prevent compile-time errors - Apply AssertSqlSafe in HistoricalQueryService hash query branches (1–3 bind variants) in persistent_store/queries/credentials.rs to align with SQLx API and accept dynamic SQL --- ares-cli/src/history/cost.rs | 3 ++- ares-cli/src/history/list.rs | 3 ++- ares-cli/src/history/search.rs | 5 +++-- ares-core/src/persistent_store/queries/credentials.rs | 7 ++++--- 4 files changed, 11 insertions(+), 7 deletions(-) diff --git a/ares-cli/src/history/cost.rs b/ares-cli/src/history/cost.rs index fcc4b7d1..2a36d77d 100644 --- a/ares-cli/src/history/cost.rs +++ b/ares-cli/src/history/cost.rs @@ -1,4 +1,5 @@ use anyhow::Result; +use sqlx::AssertSqlSafe; use chrono::Utc; use super::connect_postgres; @@ -36,7 +37,7 @@ pub(crate) async fn history_cost( bind_idx += 1; query.push_str(&format!(" ORDER BY started_at DESC LIMIT ${bind_idx}")); - let mut q = sqlx::query_as::<_, CostRow>(&query); + let mut q = sqlx::query_as::<_, CostRow>(AssertSqlSafe(query)); if let Some(ref d) = domain { q = q.bind(format!("%{d}%")); diff --git a/ares-cli/src/history/list.rs b/ares-cli/src/history/list.rs index 8ee154bd..c5f7c3e4 100644 --- a/ares-cli/src/history/list.rs +++ b/ares-cli/src/history/list.rs @@ -1,4 +1,5 @@ use anyhow::Result; +use sqlx::AssertSqlSafe; use chrono::Utc; use super::connect_postgres; @@ -48,7 +49,7 @@ pub(crate) async fn history_list( bind_idx += 1; query.push_str(&format!(" ORDER BY started_at DESC LIMIT ${bind_idx}")); - let mut q = sqlx::query_as::<_, OperationRow>(&query); + let mut q = sqlx::query_as::<_, OperationRow>(AssertSqlSafe(query)); if let Some(ref d) = domain { q = q.bind(format!("%{d}%")); diff --git a/ares-cli/src/history/search.rs b/ares-cli/src/history/search.rs index 449c639e..ed7352bb 100644 --- a/ares-cli/src/history/search.rs +++ b/ares-cli/src/history/search.rs @@ -1,4 +1,5 @@ use anyhow::Result; +use sqlx::AssertSqlSafe; use super::connect_postgres; use super::types::{CredentialSearchRow, HashSearchRow}; @@ -40,7 +41,7 @@ pub(crate) async fn history_search_creds( bind_idx += 1; query.push_str(&format!(" ORDER BY c.created_at DESC LIMIT ${bind_idx}")); - let mut q = sqlx::query_as::<_, CredentialSearchRow>(&query); + let mut q = sqlx::query_as::<_, CredentialSearchRow>(AssertSqlSafe(query)); if let Some(ref d) = domain { q = q.bind(d); @@ -139,7 +140,7 @@ pub(crate) async fn history_search_hashes( bind_idx += 1; query.push_str(&format!(" ORDER BY h.created_at DESC LIMIT ${bind_idx}")); - let mut q = sqlx::query_as::<_, HashSearchRow>(&query); + let mut q = sqlx::query_as::<_, HashSearchRow>(AssertSqlSafe(query)); if let Some(ref d) = domain { q = q.bind(d); diff --git a/ares-core/src/persistent_store/queries/credentials.rs b/ares-core/src/persistent_store/queries/credentials.rs index 88356c7e..4a65b8e1 100644 --- a/ares-core/src/persistent_store/queries/credentials.rs +++ b/ares-core/src/persistent_store/queries/credentials.rs @@ -1,6 +1,7 @@ //! Credential and hash search queries across all operations. use anyhow::Result; +use sqlx::AssertSqlSafe; use super::rows::{CredentialRow, HashRow}; use super::HistoricalQueryService; @@ -201,14 +202,14 @@ impl HistoricalQueryService { // so we use query_scalar pattern with explicit bind count match bind_values.len() { 1 => { - sqlx::query_as::<_, HashRow>(&sql) + sqlx::query_as::<_, HashRow>(AssertSqlSafe(sql)) .bind(&bind_values[0]) .bind(limit) .fetch_all(&self.pool) .await? } 2 => { - sqlx::query_as::<_, HashRow>(&sql) + sqlx::query_as::<_, HashRow>(AssertSqlSafe(sql)) .bind(&bind_values[0]) .bind(&bind_values[1]) .bind(limit) @@ -216,7 +217,7 @@ impl HistoricalQueryService { .await? } 3 => { - sqlx::query_as::<_, HashRow>(&sql) + sqlx::query_as::<_, HashRow>(AssertSqlSafe(sql)) .bind(&bind_values[0]) .bind(&bind_values[1]) .bind(&bind_values[2])