Skip to content

AB#536564: update picard dependencies and fix query builder adding (1=1) - #118

Merged
Adam Cofer (acofer) merged 2 commits into
masterfrom
AB#536564-veracode_remediation_dependency_updates
Jul 14, 2026
Merged

AB#536564: update picard dependencies and fix query builder adding (1=1)#118
Adam Cofer (acofer) merged 2 commits into
masterfrom
AB#536564-veracode_remediation_dependency_updates

Conversation

@acofer

@acofer Adam Cofer (acofer) commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Issue Link

https://dev.azure.com/nintex/Nintex/_workitems/edit/536564

High-Level Description

Updating dependencies and adjusting squirrel usage because it now evaluates squirrel.Eq{} as (1=1).

Changelog:

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Go dependencies (notably Masterminds/squirrel) and adjusts Picard’s filter/query construction to avoid generating unintended tautological SQL like (1=1) when no-op filters are applied.

Changes:

  • Updated squirrel and other Go module dependencies (via go.mod / go.sum).
  • Changed filter Apply implementations and query assembly to return/propagate nil for no-op filters and skip adding empty groups.
  • Updated local dev tooling (Makefile, .gitignore) to reflect current workflows and outputs.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
tags/tags.go Returns nil for no-op filters/groups to avoid generating (1=1) conditions with updated squirrel.
tags/tags_test.go Updates tests to assert nil for no-op NullFilter behavior.
queryparts/table.go Skips appending nil where-groups to the table’s WHERE list.
query/build.go Stores whereGroup result explicitly before adding it to the table.
Makefile Adjusts test targets and adds an update target for dependency refresh.
go.mod Updates Go version directive and bumps dependencies (including squirrel).
go.sum Updates dependency checksums corresponding to module upgrades.
.gitignore Ignores the built picard binary.
Comments suppressed due to low confidence (1)

tags/tags.go:252

  • FieldFilter.Apply does not guard against an unknown FieldName. TableMetadata.GetField returns the zero FieldMetadata when the key is missing (columnName == ""), so this currently builds an aliased expression like "t0." and produces invalid SQL instead of behaving as a no-op (consistent with NullFilter.Apply’s handling of missing columns).
	fieldMetadata := metadata.GetField(ff.FieldName)
	columnName := fieldMetadata.GetColumnName()
	expr := fmt.Sprintf(qp.AliasedField, table.Alias, columnName)
	switch ff.FilterOperator {

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread tags/tags_test.go Outdated
Comment thread tags/tags_test.go Outdated
Comment thread Makefile
Comment thread tags/tags.go

@njdullea Nathan Dullea (njdullea) left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update dependency and fixes nil where group

@acofer
Adam Cofer (acofer) merged commit 259409c into master Jul 14, 2026
1 check passed
@acofer
Adam Cofer (acofer) deleted the AB#536564-veracode_remediation_dependency_updates branch July 14, 2026 20:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants