Skip to content

fix(schema-engine): escape single quotes in enum values in migrations - #5870

Open
sebxt wants to merge 1 commit into
prisma:mainfrom
sebxt:fix/enum-values-with-single-quotes
Open

sebxt wants to merge 1 commit into
prisma:mainfrom
sebxt:fix/enum-values-with-single-quotes

Conversation

@sebxt

@sebxt sebxt commented Oct 19, 2026

Copy link
Copy Markdown

Linked issue

Refs the issue "Migrations fail when an enum value contains a single quote (Postgres, CockroachDB, MySQL)".

Summary

Enum values were wrapped in single quotes without escaping when rendering CREATE TYPE ... AS ENUM, ALTER TYPE ... ADD VALUE / DROP VALUE (Postgres and CockroachDB) and MySQL ENUM(...) column types, so a value such as @map("it's fine") produced invalid SQL. These places now go through the existing escape_string_literal helpers, the same as default values already do.

Testing performed

New test enum_values_with_single_quotes_can_be_created_added_and_removed in sql-migration-tests/tests/migrations/enums.rs. It creates an enum with a quoted value, adds another quoted value, removes a value (which recreates the enum on Postgres), and checks that the final push is a no-op.

  • Fails before the change on PostgreSQL 16 and MySQL 8 with the syntax errors from the issue; passes after.
  • Passes on CockroachDB 23.1 and SQLite.
  • cargo test -p sql-migration-tests on PostgreSQL 16 and MySQL 8: all passing, apart from the 7 postgres::extensions tests that need the extension image from docker/postgres-ext and fail the same way without this change.

Fixes #5869

Signed-off-by: Sebastian Turner <sebastiant3484@gmail.com>
@coderabbitai

coderabbitai Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: eec11cd1-f85d-47d3-9323-4013445a628d
📥 Commits

Reviewing files that changed from the base of the PR and between d1b3f37 and 15cf2af.

📒 Files selected for processing: 3
  • schema-engine/connectors/sql-schema-connector/src/flavour/mysql/renderer.rs
  • schema-engine/connectors/sql-schema-connector/src/flavour/postgres/renderer.rs
  • schema-engine/sql-migration-tests/tests/migrations/enums.rs

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

Summary by CodeRabbit

  • Bug Fixes
    • Enum values containing apostrophes are now correctly escaped when creating enums or adding and removing enum values across supported databases.
  • Tests
    • Added coverage for creating, updating, and reapplying schemas with enum values that contain apostrophes.

Walkthrough

Enum SQL rendering now escapes apostrophes in values for MySQL, PostgreSQL, and CockroachDB. The changes cover enum creation, additions, removals, and replacement migrations. A migration test exercises enum values containing apostrophes and checks that a repeated schema push produces no migration steps.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 15cf2

No actionable issue remains from this review; the change is mergeable after normal checks.

Security architecture risk: ⚪ Minimal · up to 15cf2

The change corrects quoted enum values without adding access paths or privileges. No material security regression was identified, and the existing migration ordering is preserved.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The affected inputs are enum values obtained from existing schema walkers and migration deltas, and the outputs remain SQL statements for the existing connector paths. The edits do not introduce another input channel, database target, or privilege source.

Trust Boundaries and Controls

  • observed — The quoting wrappers supply delimiters but do not escape their contents. The changed enum paths now explicitly apply the same apostrophe-doubling convention already used for defaults. This supports the reported apostrophe correction, not a claim of comprehensive SQL-injection protection across all inputs or database modes.
Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 3 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks: 4 passed
Check name Status Explanation
Title check Passed The title clearly and concisely describes the primary change: escaping single quotes in enum values during migrations.
Description check Passed The description is directly related to the changes. It explains the affected connectors, the escaping fix, the regression test, and the reported test results.
Linked Issues check Passed Issue #5869 requires escaping single quotes in enum SQL for PostgreSQL, CockroachDB, and MySQL. The reviewed changes route enum values through escape_string_literal in the PostgreSQL/CockroachDB cre…
Out of Scope Changes check Passed The changes are limited to enum literal rendering in the PostgreSQL and MySQL schema connectors and a focused enum migration test. These changes directly implement issue #5869. No unrelated behavior o…
Full details: Linked Issues check

Explanation

Issue #5869 requires escaping single quotes in enum SQL for PostgreSQL, CockroachDB, and MySQL. The reviewed changes route enum values through escape_string_literal in the PostgreSQL/CockroachDB create and alter renderers and the MySQL enum column renderer. The added migration test covers creation, addition, removal, stored values, and an idempotent final push. The supplied test results report success on PostgreSQL, MySQL, CockroachDB, and SQLite.

Full details: Out of Scope Changes check

Explanation

The changes are limited to enum literal rendering in the PostgreSQL and MySQL schema connectors and a focused enum migration test. These changes directly implement issue #5869. No unrelated behavior or files are identified.

  • Fix all pre-merge checks with AI
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
✨ Simplify code
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Migrations fail when an enum value contains a single quote (Postgres, CockroachDB, MySQL)

1 participant