Conditions wrap (#5535)

* Added parentheses wrapping for `not`, `or`, `and` operators, related tests; removed leftover debug file

* Synced postpone date, test case fix

* Additional test fixes

* beta.20

---------

Co-authored-by: AndriiSherman <andreysherman11@gmail.com>

Author: Sukairo-02

changelogs/drizzle-orm/1.0.0-beta.20.md

@@ -0,0 +1,4 @@
+- Fixed `sql.identifier()`, `sql.as()` escaping issues. Previously all the values passed to this functions were not properly escaped
+causing a possible SQL Injection (CWE-89) vulnerability
+
+Thanks to @EthanKim88, @0x90sh and @wgoodall01 for reaching out to us with a reproduction and suggested fix

drizzle-kit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "drizzle-kit",
-	"version": "1.0.0-beta.19",
+	"version": "1.0.0-beta.20",
 	"homepage": "https://orm.drizzle.team",
 	"keywords": [
 		"drizzle",

drizzle-kit/tests/postgres/pg-constraints.test.ts

@@ -2419,7 +2419,7 @@ test('generated + unique', async (t) => {
 	expect(st).toStrictEqual([
 		`ALTER TABLE \"table\" RENAME COLUMN \"column2\" TO \"column3\";`,
 		`ALTER TABLE \"table\" DROP COLUMN \"bool\";`,
-		`ALTER TABLE \"table\" ADD COLUMN \"bool\" boolean GENERATED ALWAYS AS (((\"table\".\"column1\" is null) and (\"table\".\"column3\" is null))) STORED;`,
+		`ALTER TABLE \"table\" ADD COLUMN \"bool\" boolean GENERATED ALWAYS AS ((((\"table\".\"column1\" is null)) and ((\"table\".\"column3\" is null)))) STORED;`,
 		'ALTER TABLE "table" ADD CONSTRAINT "table_bool_key" UNIQUE("bool");',
 	]);
 	// push is not triggered on generated change
@@ -2467,7 +2467,7 @@ test('generated + pk', async (t) => {
 	expect(st).toStrictEqual([
 		`ALTER TABLE \"table\" RENAME COLUMN \"column2\" TO \"column3\";`,
 		`ALTER TABLE \"table\" DROP COLUMN \"bool\";`,
-		`ALTER TABLE \"table\" ADD COLUMN \"bool\" boolean PRIMARY KEY GENERATED ALWAYS AS (((\"table\".\"column1\" is null) and (\"table\".\"column3\" is null))) STORED;`,
+		`ALTER TABLE \"table\" ADD COLUMN \"bool\" boolean PRIMARY KEY GENERATED ALWAYS AS ((((\"table\".\"column1\" is null)) and ((\"table\".\"column3\" is null)))) STORED;`,
 	]);
 	// push is not triggered on generated change
 	expect(pst).toStrictEqual([

drizzle-kit/tests/postgres/pg-indexes.test.ts

@@ -570,7 +570,7 @@ test('index #4', async (t) => {
 	expect(st).toStrictEqual([
 		`ALTER TABLE \"table\" RENAME COLUMN \"column2\" TO \"column3\";`,
 		`ALTER TABLE \"table\" DROP COLUMN \"bool\";`,
-		`ALTER TABLE \"table\" ADD COLUMN \"bool\" boolean GENERATED ALWAYS AS (((\"table\".\"column1\" is null) and (\"table\".\"column3\" is null))) STORED;`,
+		`ALTER TABLE \"table\" ADD COLUMN \"bool\" boolean GENERATED ALWAYS AS ((((\"table\".\"column1\" is null)) and ((\"table\".\"column3\" is null)))) STORED;`,
 		`CREATE INDEX "table_uid_bool_idx" ON "table" ("uid","bool");`,
 	]);
 	// push is not triggered on generated change

drizzle-kit/tests/postgres/pg-views.test.ts

@@ -2045,7 +2045,7 @@ test('.as in view select', async () => {
 				.from(user)
 				.leftJoin(
 					userSubscription,
-					sql`(${user.id} = ${userSubscription.userId} and (${userSubscription.status} = 'active' or ${userSubscription.status} = 'trialing'))`,
+					sql`((${user.id} = ${userSubscription.userId}) and (((${userSubscription.status} = 'active') or (${userSubscription.status} = 'trialing'))))`,
 				);
 		},
 	);
@@ -2084,8 +2084,8 @@ test('.as in view select', async () => {
 	const expectedSt1View = (viewName: string) =>
 		`CREATE VIEW "${viewName}" AS `
 		+ `(select "user"."id" as "userId", "user"."email", "user"."name", "user_subscription"."id" as "subscriptionId", "user_subscription"."status" `
-		+ `from "user" left join "user_subscription" on ("user"."id" = "user_subscription"."userId" `
-		+ `and ("user_subscription"."status" = 'active' or "user_subscription"."status" = 'trialing')));`;
+		+ `from "user" left join "user_subscription" on (("user"."id" = "user_subscription"."userId") `
+		+ `and ((("user_subscription"."status" = 'active') or ("user_subscription"."status" = 'trialing')))));`;
 	const expectedSt1 = [
 		'CREATE TABLE "user" (\n\t"id" serial PRIMARY KEY,\n\t"email" text,\n\t"name" text\n);\n',
 		'CREATE TABLE "user_subscription" (\n\t"id" serial PRIMARY KEY,\n\t"userId" integer,\n\t"status" text\n);\n',

drizzle-orm/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "drizzle-orm",
-	"version": "1.0.0-beta.19",
+	"version": "1.0.0-beta.20",
 	"description": "Drizzle ORM package for SQL databases",
 	"type": "module",
 	"scripts": {