Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid using magic string values for JsonNull/DbNull #9243

Closed
matthijs-relay opened this issue Sep 14, 2021 · 1 comment · Fixed by #13783
Closed

Avoid using magic string values for JsonNull/DbNull #9243

matthijs-relay opened this issue Sep 14, 2021 · 1 comment · Fixed by #13783
Labels
kind/improvement An improvement to existing feature and code. team/client Issue for team Client. tech/typescript Issue for tech TypeScript. topic: breaking change topic: Json Scalar type `Json`
Milestone

Comments

@matthijs-relay
Copy link

matthijs-relay commented Sep 14, 2021

Problem

Since Prisma 3.0, the input for filtering and updating nullable JSON fields no longer accepts null, but instead the Prisma.JsonNull and Prisma.DbNull values to better distinguish between the two types of nulls.

I can see that this solves a real problem, but the current implementation has a significant drawback: JsonNull and DbNull are implemented as magic string values. This means their types overlap with regular string data that can be stored in a JSON field. Some problems this could cause:

  • Filtering/storing Prisma.DbNull on a non-nullable JSON field will type-check, but produce a JSON string value of "DbNull" instead of an actual NULL, which may lead to confusing bugs
  • User-provided strings that get stored as a top-level value in a JSON field need to be sanitized to make sure they're not "JsonNull" or "DbNull", or users might be able to inject either kind of null value and cause an unexpected state

Suggested solution

A possible alternative approach would be making JsonNull and DbNull Symbols or some kind of class instance, so that they don't overlap with the JsonValue type

@janpio janpio added team/client Issue for team Client. kind/improvement An improvement to existing feature and code. topic: Json Scalar type `Json` labels Sep 14, 2021
@aqrln aqrln added the tech/typescript Issue for tech TypeScript. label Nov 25, 2021
@aqrln
Copy link
Member

aqrln commented Jun 24, 2022

This issue is now fixed, and the change will be released in Prisma 4.0.0.

DbNull, JsonNull and AnyNull will now be singleton instances of their eponymous classes. We eventually settled on this design after making them symbols first because it allows for better type errors, and thus better DX (but you may still see "symbols" being referenced in some public GitHub issues used for planning and orchestrating this change).

@janpio janpio added this to the 4.0.0 milestone Jun 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/improvement An improvement to existing feature and code. team/client Issue for team Client. tech/typescript Issue for tech TypeScript. topic: breaking change topic: Json Scalar type `Json`
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants