Prevent JavaScript in query selections #1021

KyleAMathews · 2025-12-15T14:07:33Z

Adds detection and helpful error messages when users mistakenly use JavaScript operators (||, &&, ??) in query callbacks. These operators are evaluated at query construction time, not execution time, causing silent unexpected behavior.

Changes:

Add JavaScriptOperatorInQueryError with helpful suggestions
Add Symbol.toPrimitive trap to RefProxy for primitive coercion
Add checkCallbackForJsOperators() to detect operators in callbacks
Integrate checks into select(), where(), and having() methods
Add comprehensive tests for the new error detection
Fix existing tests that incorrectly used JS operators

🎯 Changes

✅ Checklist

I have followed the steps in the Contributing guide.
I have tested this code locally with pnpm test:pr.

🚀 Release Impact

This change affects published code, and I have generated a changeset.
This change is docs/CI/dev-only (no release).

Adds detection and helpful error messages when users mistakenly use JavaScript operators (||, &&, ??) in query callbacks. These operators are evaluated at query construction time, not execution time, causing silent unexpected behavior. Changes: - Add JavaScriptOperatorInQueryError with helpful suggestions - Add Symbol.toPrimitive trap to RefProxy for primitive coercion - Add checkCallbackForJsOperators() to detect operators in callbacks - Integrate checks into select(), where(), and having() methods - Add comprehensive tests for the new error detection - Fix existing tests that incorrectly used JS operators

changeset-bot · 2025-12-15T14:07:37Z

🦋 Changeset detected

Latest commit: bd823a1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 12 packages

Name	Type
@tanstack/db	Patch
@tanstack/angular-db	Patch
@tanstack/electric-db-collection	Patch
@tanstack/offline-transactions	Patch
@tanstack/powersync-db-collection	Patch
@tanstack/query-db-collection	Patch
@tanstack/react-db	Patch
@tanstack/rxdb-db-collection	Patch
@tanstack/solid-db	Patch
@tanstack/svelte-db	Patch
@tanstack/trailbase-db-collection	Patch
@tanstack/vue-db	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2025-12-15T14:23:45Z

More templates

@tanstack/angular-db

npm i https://pkg.pr.new/@tanstack/angular-db@1021

@tanstack/db

npm i https://pkg.pr.new/@tanstack/db@1021

@tanstack/db-ivm

npm i https://pkg.pr.new/@tanstack/db-ivm@1021

@tanstack/electric-db-collection

npm i https://pkg.pr.new/@tanstack/electric-db-collection@1021

@tanstack/offline-transactions

npm i https://pkg.pr.new/@tanstack/offline-transactions@1021

@tanstack/powersync-db-collection

npm i https://pkg.pr.new/@tanstack/powersync-db-collection@1021

@tanstack/query-db-collection

npm i https://pkg.pr.new/@tanstack/query-db-collection@1021

@tanstack/react-db

npm i https://pkg.pr.new/@tanstack/react-db@1021

@tanstack/rxdb-db-collection

npm i https://pkg.pr.new/@tanstack/rxdb-db-collection@1021

@tanstack/solid-db

npm i https://pkg.pr.new/@tanstack/solid-db@1021

@tanstack/svelte-db

npm i https://pkg.pr.new/@tanstack/svelte-db@1021

@tanstack/trailbase-db-collection

npm i https://pkg.pr.new/@tanstack/trailbase-db-collection@1021

@tanstack/vue-db

npm i https://pkg.pr.new/@tanstack/vue-db@1021

commit: bd823a1

github-actions · 2025-12-15T14:24:21Z

Size Change: +1.11 kB (+1.24%)

Total Size: 90.6 kB

Filename	Size	Change
`./packages/db/dist/esm/errors.js`	4.55 kB	+284 B (+6.65%)	🔍
`./packages/db/dist/esm/index.js`	2.7 kB	+20 B (+0.75%)
`./packages/db/dist/esm/query/builder/index.js`	3.99 kB	+27 B (+0.68%)
`./packages/db/dist/esm/query/builder/ref-proxy.js`	1.7 kB	+782 B (+85.28%)	🆘

ℹ️ View Unchanged

Filename	Size
`./packages/db/dist/esm/collection/change-events.js`	1.39 kB
`./packages/db/dist/esm/collection/changes.js`	999 B
`./packages/db/dist/esm/collection/events.js`	388 B
`./packages/db/dist/esm/collection/index.js`	3.24 kB
`./packages/db/dist/esm/collection/indexes.js`	1.1 kB
`./packages/db/dist/esm/collection/lifecycle.js`	1.67 kB
`./packages/db/dist/esm/collection/mutations.js`	2.34 kB
`./packages/db/dist/esm/collection/state.js`	3.46 kB
`./packages/db/dist/esm/collection/subscription.js`	3.62 kB
`./packages/db/dist/esm/collection/sync.js`	2.38 kB
`./packages/db/dist/esm/deferred.js`	207 B
`./packages/db/dist/esm/event-emitter.js`	748 B
`./packages/db/dist/esm/indexes/auto-index.js`	742 B
`./packages/db/dist/esm/indexes/base-index.js`	766 B
`./packages/db/dist/esm/indexes/btree-index.js`	1.93 kB
`./packages/db/dist/esm/indexes/lazy-index.js`	1.1 kB
`./packages/db/dist/esm/indexes/reverse-index.js`	513 B
`./packages/db/dist/esm/local-only.js`	837 B
`./packages/db/dist/esm/local-storage.js`	2.1 kB
`./packages/db/dist/esm/optimistic-action.js`	359 B
`./packages/db/dist/esm/paced-mutations.js`	496 B
`./packages/db/dist/esm/proxy.js`	3.75 kB
`./packages/db/dist/esm/query/builder/functions.js`	733 B
`./packages/db/dist/esm/query/compiler/evaluators.js`	1.35 kB
`./packages/db/dist/esm/query/compiler/expressions.js`	430 B
`./packages/db/dist/esm/query/compiler/group-by.js`	1.8 kB
`./packages/db/dist/esm/query/compiler/index.js`	1.96 kB
`./packages/db/dist/esm/query/compiler/joins.js`	2 kB
`./packages/db/dist/esm/query/compiler/order-by.js`	1.46 kB
`./packages/db/dist/esm/query/compiler/select.js`	1.07 kB
`./packages/db/dist/esm/query/expression-helpers.js`	1.43 kB
`./packages/db/dist/esm/query/ir.js`	673 B
`./packages/db/dist/esm/query/live-query-collection.js`	360 B
`./packages/db/dist/esm/query/live/collection-config-builder.js`	5.33 kB
`./packages/db/dist/esm/query/live/collection-registry.js`	264 B
`./packages/db/dist/esm/query/live/collection-subscriber.js`	1.9 kB
`./packages/db/dist/esm/query/live/internal.js`	130 B
`./packages/db/dist/esm/query/optimizer.js`	2.56 kB
`./packages/db/dist/esm/query/predicate-utils.js`	2.97 kB
`./packages/db/dist/esm/query/subset-dedupe.js`	921 B
`./packages/db/dist/esm/scheduler.js`	1.3 kB
`./packages/db/dist/esm/SortedMap.js`	1.3 kB
`./packages/db/dist/esm/strategies/debounceStrategy.js`	247 B
`./packages/db/dist/esm/strategies/queueStrategy.js`	428 B
`./packages/db/dist/esm/strategies/throttleStrategy.js`	246 B
`./packages/db/dist/esm/transactions.js`	2.9 kB
`./packages/db/dist/esm/utils.js`	881 B
`./packages/db/dist/esm/utils/browser-polyfills.js`	304 B
`./packages/db/dist/esm/utils/btree.js`	5.61 kB
`./packages/db/dist/esm/utils/comparison.js`	852 B
`./packages/db/dist/esm/utils/cursor.js`	457 B
`./packages/db/dist/esm/utils/index-optimization.js`	1.51 kB
`./packages/db/dist/esm/utils/type-guards.js`	157 B

_{compressed-size-action::db-package-size}

github-actions · 2025-12-15T14:24:58Z

Size Change: 0 B

Total Size: 3.35 kB

ℹ️ View Unchanged

Filename	Size
`./packages/react-db/dist/esm/index.js`	225 B
`./packages/react-db/dist/esm/useLiveInfiniteQuery.js`	1.17 kB
`./packages/react-db/dist/esm/useLiveQuery.js`	1.12 kB
`./packages/react-db/dist/esm/useLiveSuspenseQuery.js`	431 B
`./packages/react-db/dist/esm/usePacedMutations.js`	401 B

_{compressed-size-action::react-db-package-size}

- Add ternary operator (?:) detection to JS operator patterns - Add tests for ternary detection and regex literal edge case - Fix e2e test to use coalesce() instead of ?? - Add changeset 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>

KyleAMathews requested a review from samwillis December 15, 2025 14:07

autofix-ci bot and others added 3 commits December 15, 2025 14:08

ci: apply automated fixes

ddc3b47

fix(db): fix TypeScript type error in checkCallbackForJsOperators

05ea010

ci: apply automated fixes

7c6c537

KyleAMathews added this to 1.0.0 release Jan 6, 2026

KyleAMathews moved this to In Progress in 1.0.0 release Jan 6, 2026

KyleAMathews and others added 3 commits January 6, 2026 09:21

Merge remote-tracking branch 'origin/main' into pr-1021

8228ce5

ci: apply automated fixes

bd823a1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Prevent JavaScript in query selections #1021

Prevent JavaScript in query selections #1021

Uh oh!

KyleAMathews commented Dec 15, 2025

Uh oh!

changeset-bot bot commented Dec 15, 2025 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Dec 15, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 15, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 15, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Prevent JavaScript in query selections #1021

Are you sure you want to change the base?

Prevent JavaScript in query selections #1021

Uh oh!

Conversation

KyleAMathews commented Dec 15, 2025

🎯 Changes

✅ Checklist

🚀 Release Impact

Uh oh!

changeset-bot bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

changeset-bot bot commented Dec 15, 2025 •

edited

Loading

pkg-pr-new bot commented Dec 15, 2025 •

edited

Loading

github-actions bot commented Dec 15, 2025 •

edited

Loading

github-actions bot commented Dec 15, 2025 •

edited

Loading