queryparam should not accept arrays when list=false

Description

i love being able to pass arrays, but it should be opt in, not auto magical

this behaviour only makes sense for a single use case

i.e. with

WHERE id in (<cfqueryparam...>)

otherwise it generates invalid sql

WHERE id = 1,2

and Lucee has several ways for user input to become arrays

I believe it’s also a minor performance issue, as we don’t need to check if every queryparam is a list or an array

https://github.com/lucee/Lucee/blob/5.3/core/src/main/java/lucee/runtime/tag/util/QueryParamConverter.java#L296

Environment

Activity

Pothys - MitrahSoft 
10 May 2024 at 10:12

Thanks for your clarification . It seems to be resolved and works as expected. So, I'll close this ticket.

Zac Spitzer 
9 May 2024 at 20:18
(edited)

I thought with the first round of changes, the default became null, which only allows arrays, thus preserving previous Lucee behaviour

I don't quite follow what you're suggesting tho, you're saying the default is now true, but then propose to make it true?

Is there a test passing which shouldn't? I think we have pretty good coverage on this, otherwise if there's something missing test wise, can you file a PR?

Pothys - MitrahSoft 
9 May 2024 at 14:55

I've reviewed the issue with Lucee versions 6.1.0.135-SNAPSHOT and 6.0.2.33-SNAPSHOT. When passing an array with 'list=false' it throws an error. Setting 'list=true' or not defining the 'list' attribute allows the array to pass, and it works fine. However, the default value for the 'list' attribute of the cfqueryparam tag is now true, which is not compatible with ACF.

Would you like me to update the default value of the 'list' attribute to true for cfqueryparam in Lucee?

Zac Spitzer 
19 April 2024 at 10:13
(edited)

Turns out, we forgot to handle when arguments are passed as params

https://github.com/lucee/Lucee/pull/2349

updated the docs too

https://github.com/lucee/lucee-docs/commit/1c21526084797f1a5fdbfe75a4d97bf339a5710c

Zac Spitzer 
28 February 2022 at 17:02
(edited)

So after some discussion, we have changed how this works,

the major problem previously was list=false would not disable the array approach,

Now when list isn’t defined, the existing behavior remains

I added some test cases https://github.com/lucee/Lucee/pull/1579

However, one of the tests is failing when passing an array in with list=false, my understand is it should throw an error

Fixed

Details

Assignee

Reporter

Priority

Labels

Fix versions

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Created 27 February 2022 at 15:50
Updated 23 January 2025 at 17:13
Resolved 14 March 2022 at 14:32