Wrong queries causes unhandled exceptions

[regevbr]

Steps to reproduce

Run a select query (all()) with order by on a bogus field that includes ? char in it
https://github.com/strongloop/loopback-connector/blob/deb461ea62e6226f053774fb10c1f023d6061f8c/lib/sql.js#L1455-L1459

Current Behavior

an unhandled exception caused by the buildSelect() method due to ParameterizedSQL class assertion error:

https://github.com/strongloop/loopback-connector/blob/deb461ea62e6226f053774fb10c1f023d6061f8c/lib/parameterized-sql.js#L38-L42

Which in turn means that the callback is never called, causing connections to hang

Expected Behavior

cb() should be called with the proper error

[regevbr]

quick and dirty solution is to tyr/catch the call to buildSelect
A more correct solution will be to sanitize the fields used for order by, like done in fields selection

[dhmlau]

@regevbr , would you like to submit a PR? Thanks.

[regevbr]

@dhmlau sure, which solution would you prefer?

[jannyHou]

@regevbr Thank you for willing to submit a patch, I think you can start with try catch the error for buildSelect to at least reports a proper error instead of the app hangs.
Then you can add a new test reproduce the failure and add the sanitization for buildSelect, maybe in a separate PR.
Let us know if you have any questions.

[regevbr]

Sounds good!

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been closed due to continued inactivity. Thank you for your understanding. If you believe this to be in error, please contact one of the code owners, listed in the CODEOWNERS file at the top-level of this repository.

[ewrayjohnson]

I have encountered this error and have a unique perspective on the cause. In my case one of the parameters is a very large Buffer. The assert statement always appends the parameters even if the assertion is true and the parameters are never displayed.