Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

CodeGen: value-list values are not escaped in generated TypeScript (union/z.literal) or the EntityFieldValue INSERT

Open Beginner friendly
  • Is something wrong?
#5,952 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
postgresql, sql, typescript
Domain
backend, databases

Research direction

Read the value-list interpolation points in packages/CodeGenLib/src/Misc/entity_subclasses_codegen.ts at lines 529 and 1650, then inspect EscapeSingleQuotes() nearby. Also read the INSERT in packages/CodeGenLib/src/Database/manage-metadata.ts at line 6595. Reproduce with values containing a backslash and an apostrophe; done means generated TypeScript builds and both values are stored correctly.

Written by the indexing model from the issue text.

Description

Summary

CodeGen interpolates value-list values (EntityFieldValue.Value) into generated code and SQL without escaping them. A value containing a backslash or a single quote produces invalid TypeScript, which breaks the GeneratedEntities build. In the SQL path, such a value is silently dropped from the value list.

Seen on @memberjunction/codegen-lib 6.1.6 (PostgreSQL). The same code is unchanged on next (f135c8cf).

Where

All three places wrap the raw value in quotes:

File (next) Line Code
packages/CodeGenLib/src/Misc/entity_subclasses_codegen.ts 529 sortedValues.map((v) => `${quotes}${v.Value}${quotes}`).join(' | ') (TS union type for the getter/setter)
packages/CodeGenLib/src/Misc/entity_subclasses_codegen.ts 1650 sortedValues.map((v) => `z.literal(${quotes}${v.Value}${quotes})`) (Zod schema)
packages/CodeGenLib/src/Database/manage-metadata.ts 6595 ... '${v}', '${v}', ... in the syncEntityFieldValues INSERT (Value and Code)

EntitySubClassGeneratorBase.EscapeSingleQuotes() already exists in the same file (escapes \ and ') and is used for relationship names. It is not applied to value-list values.

Reproduce

  1. Add a soft value list through additionalSchemaInfo (Fields[].PossibleValues) on a string column, with values containing a backslash and an apostrophe, for example ["PASS", "FAIL", "\\"] and ["General", "Women's Network"]. A CHECK-constraint-derived list would hit the same code.
  2. Run mj codegen.

What happens

  • Backslash. The Zod schema gets z.literal('\'). The backslash escapes the closing quote, so tsc reports thousands of TS1005 / TS1434 errors from that line to the end of the file. The AFTER command npm run build in GeneratedEntities fails.
  • Single quote. The INSERT becomes VALUES (..., 'Women's Network', 'Women's Network', ...), a SQL syntax error. That value never reaches EntityFieldValue; the other values of the list are stored, so the list is silently incomplete. The same interpolation also lets a value inject SQL.
  • Hard to recover from. After the first run, applyValueListForField skips any field that already has EntityFieldValue rows. Removing the bad value from additionalSchemaInfo therefore does not remove it from the database. The row has to be deleted by hand before the TypeScript can be regenerated cleanly.

Expected

Values are emitted as valid string literals whatever characters they contain. Either:

  • run them through EscapeSingleQuotes, or
  • use JSON.stringify(v.Value) for the TS/Zod output, and a parameterized query (or proper SQL quoting) for the INSERT.

Numeric value lists (NeedsQuotes === false) are unaffected.

Context

This came from loading data-derived value lists for a large connector schema (about 2,200 fields). Real operational data contains stray characters, such as a lone \ entered as a grade, and labels with apostrophes. Any data-driven value list will eventually hit this.

🤖 Generated with Claude Code

Dominant language
TSQL
Stars
32
Forks
7
Avg merge
1d 11h
Merged PRs (30d)
714

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from MemberJunction/MJ

All issues in MemberJunction/MJ

Similar issues

More Backend & API Design issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.