🐛 quote sqlv8 values

tediousjs · Mar 20, 2023 · 75bd474 · 75bd474
1 parent a551621
commit 75bd474
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 3 deletions.
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
@@ -1,4 +1,8 @@
-v9.1.1 (2023-01-??)
+v9.1.2 (2023-??-??)
+-------------------
+[fix] Escape values that are added to the msnodesqlv8 connection string that we construct ((#1479)[https://github.com/tediousjs/node-mssql/pull/1479])
+
+v9.1.1 (2023-01-18)
 -------------------
 [revert] Add support for AAD authentication via connection string ((#1436)[https://github.com/tediousjs/node-mssql/pull/1436])
 

diff --git a/lib/msnodesqlv8/connection-pool.js b/lib/msnodesqlv8/connection-pool.js
@@ -38,8 +38,14 @@ class ConnectionPool extends BaseConnectionPool {
             return this.config.options.trustedConnection ? 'Yes' : 'No'
           case 'encrypt':
             return this.config.options.encrypt ? 'Yes' : 'No'
-          default:
-            return this.config[key] != null ? this.config[key] : ''
+          default: {
+            let val = this.config[key] || ''
+            if (val && typeof val === 'string') {
+              // quote values in `{}` and escape any existing `}` chars
+              val = `{${val.replace(/}/g, '}}')}`
+            }
+            return val
+          }
         }
       })