From 99b87beb10464bde73631a977606edde2a523a79 Mon Sep 17 00:00:00 2001 From: Étienne Deparis Date: Sat, 28 Mar 2020 14:55:45 +0100 Subject: feat: Better protect update_status method --- lib/sqlite_helper.rb | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/lib/sqlite_helper.rb b/lib/sqlite_helper.rb index bfcc391..cc77647 100644 --- a/lib/sqlite_helper.rb +++ b/lib/sqlite_helper.rb @@ -82,7 +82,7 @@ module SqliteHelper parse_status_details(status) end - def update_status(new_details, email) + def build_fields_and_bindings(new_details) fields = [] bindings = [] new_details.each do |k, v| @@ -95,9 +95,15 @@ module SqliteHelper @details[k] = v end end + [fields, bindings] + end + + def update_status(new_details, email) + mapping = build_fields_and_bindings(new_details) + fields = mapping[0].join(', ') + ',' @db.execute( - "UPDATE statuses SET #{fields.join(', ')}, details = ? WHERE email = ?;", - bindings + [YAML.dump(@details), email] + "UPDATE statuses SET #{fields} details = ? WHERE email = ?;", + mapping[1] + [YAML.dump(@details), email] ) end end -- cgit v1.2.1