forked from MarseyWorld/MarseyWorld
Snakes
9eab252e5b
Consider the case of the current /notifications filter condition:
WHERE ... NOT ((comments.sentto = 2) AND (users.is_muted))
SELECT 1 WHERE NOT ((null = 2) AND (true)); ⇒ 0 rows
SELECT 1 WHERE NOT ((1 = 2) AND (true)); ⇒ 1 row
SELECT 1 WHERE NOT ((2 = 2) AND (true)); ⇒ 0 rows
We want the first expression, where comments.sentto = null, to evaluate
to false, not to null, so it negates to true. Behavior as written is:
SELECT 1 WHERE NOT ((null = 2) AND (true)); →
SELECT 1 WHERE NOT (null AND true); →
SELECT 1 WHERE NOT null; →
SELECT 1 WHERE null;
Which guarantees a null return set. If we check first for non-nullity:
SELECT 1 WHERE NOT ((null IS NOT null) AND (null = 2) AND (true)); ⇒ 1
SELECT 1 WHERE NOT ((1 IS NOT null) AND (1 = 2) AND (true)); ⇒ 1
SELECT 1 WHERE NOT ((2 IS NOT null) AND (2 = 2) AND (true)); ⇒ 0
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| admin.py | ||
| allroutes.py | ||
| asset_submissions.py | ||
| awards.py | ||
| casino.py | ||
| chat.py | ||
| comments.py | ||
| errors.py | ||
| feeds.py | ||
| front.py | ||
| giphy.py | ||
| hats.py | ||
| jinja2.py | ||
| login.py | ||
| lottery.py | ||
| mail.py | ||
| notifications.py | ||
| oauth.py | ||
| polls.py | ||
| posts.py | ||
| reporting.py | ||
| routehelpers.py | ||
| search.py | ||
| settings.py | ||
| static.py | ||
| streamers.py | ||
| subs.py | ||
| users.py | ||
| votes.py | ||
| wrappers.py | ||