fix(codegen): embed user strings into generated ObjectScript correctly - #93
Open
PYDuquesnoy wants to merge 1 commit into
Open
Conversation
Every tool that generated ObjectScript embedded user-supplied strings with the wrong escaping for the context: SQL-style '' doubling (or C-style \") inside ObjectScript "..." literals. ObjectScript escapes a quote inside a literal by doubling it; backslash is an ordinary character. Consequences: - iris_lookup_transfer import failed 100% with <SYNTAX> - XML always carries attribute quotes, and \" tears the literal open - values containing ' were silently corrupted to '' on write: lookup values, credential passwords, Security.Users passwords, item settings - values containing " or newlines crashed the generated routine New module `objectscript` renders any string as a safe single-line expression (quotes doubled, control chars via $CHAR, long payloads chunked across Write statements), used by every ObjectScript-context embed site in interop.rs, admin.rs and dict.rs. SQL-context escapes are untouched. Fixes intersystems-community#92 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #92
What
Every tool that generates ObjectScript embedded user-supplied strings into ObjectScript
"..."literals with the wrong escaping for the context: SQL-style''doubling, or C-style\\/\". ObjectScript escapes a quote inside a literal by doubling it (""); backslash is an ordinary character. As a result:iris_lookup_transfer action=importfailed 100% with<SYNTAX>—%ExportXML always carries attribute quotes, and\"tears the literal open'were silently written doubled (success:true): credential passwords (Ens.Config.Credentials.SetCredential),Security.Userspasswords, lookup values, production item settings"or newlines crashed the generated routineHow
New module
crates/iris-agentic-dev-core/src/objectscript.rs:os_str_expr(s)— renders any string as a single-line ObjectScript expression: printable runs become quoted literals with"doubled, control characters are spliced via$CHAR(n,...)(a literal cannot span source lines, and the exec-class builder splits on\n)os_stream_write_stmts(var, payload, chunk)— chunkedDo var.Write(...)statements for long payloads (the import XML), so no generated line approaches the routine line-length limitConverted every ObjectScript-context embed site:
tools/interop.rs— production item enable/disable/get_settings/set_settings, credential create/update/delete, lookup manage get/set/delete/list_keys, lookup transfer export/import (import now goes throughbuild_lookup_import_code, unit-tested), autostart settools/admin.rs— user get-roles/create/modify/delete, security check, namespace create/delete, webapp get/create/deletetools/dict.rs—build_message_map_codeclass-name embedSQL-context escapes (
iris.querypaths,coverage.rs,info.rs) are untouched —''doubling is correct there.The unit tests that asserted the wrong escaping (
production_item_escape_in_objectscript_code,credential_*_escaping,xml_escaping_backslash_and_quote) now assert the correct behavior, plus new tests that feed real quote-heavy multi-line XML through the import code builder and check every generated line holds only balanced literals.Testing
cargo buildclean,cargo clippy --all-targetsclean,cargo fmtappliedcargo test -p iris-agentic-dev-core --lib: 1002 passed, 0 failederror_codeas a pass, which is how the 7/7 import failures stayed green) and exercises a quote/apostrophe/accent value against a live IRISThis is a port of intersystems-ib/iris-interop-dev#7 (where the bug was found and fixed against a 0.6.x base), re-applied onto current master.
🤖 Generated with Claude Code