Fix: remove escapeValue in favor of SQL placeholder

src/services/repository/tables/insert-column-values.spec.tsx

@@ -4,8 +4,10 @@ import { randomUUID } from 'node:crypto';
 import { connectAndClose } from '~/services/db/duckdb';
 import { createDatasetTable } from './create-table';
 import { deleteDatasetTable } from './delete-table';
+import { deleteDatasetTableRows } from './delete-table-rows';
 import { upsertColumnValues } from './insert-column-values';
 import { getColumnName, getDatasetTableName } from './utils';
+import { DuckDBBlobValue } from '@duckdb/node-api';
 
 const dataset = {
   id: randomUUID(),
@@ -17,6 +19,21 @@ afterEach(async () => {
   await deleteDatasetTable(dataset);
 });
 
+const clearDatasetTable = async ({
+  dataset,
+}: {
+  dataset: {
+    id: string;
+    name: string;
+    createdBy: string;
+  };
+}): Promise<void> => {
+  await deleteDatasetTableRows({
+    dataset,
+    rowIdxs: Array.from({ length: 1000 }, (_, i) => i),
+  });
+};
+
 describe('insert-column-values', () => {
   it('should insert values from a generator function', async () => {
     const column = {
@@ -30,6 +47,10 @@ describe('insert-column-values', () => {
       columns: [column],
     });
 
+    await clearDatasetTable({
+      dataset,
+    });
+
     await upsertColumnValues({
       dataset,
       column,
@@ -78,6 +99,10 @@ describe('insert-column-values', () => {
       columns: [column],
     });
 
+    await clearDatasetTable({
+      dataset,
+    });
+
     await upsertColumnValues({
       dataset,
       column,
@@ -136,6 +161,10 @@ describe('insert-column-values', () => {
       columns: [column],
     });
 
+    await clearDatasetTable({
+      dataset,
+    });
+
     await upsertColumnValues({
       dataset,
       column,
@@ -184,6 +213,10 @@ describe('insert-column-values', () => {
       columns: [column],
     });
 
+    await clearDatasetTable({
+      dataset,
+    });
+
     await upsertColumnValues({
       dataset,
       column,
@@ -220,6 +253,10 @@ describe('insert-column-values', () => {
       columns: [column],
     });
 
+    await clearDatasetTable({
+      dataset,
+    });
+
     await upsertColumnValues({
       dataset,
       column,
@@ -268,6 +305,10 @@ describe('insert-column-values', () => {
       columns: [column],
     });
 
+    await clearDatasetTable({
+      dataset,
+    });
+
     await upsertColumnValues({
       dataset,
       column,
@@ -291,4 +332,46 @@ describe('insert-column-values', () => {
       ]);
     });
   });
+
+  it('should insert Uint8Array as BLOB', async () => {
+    const column = {
+      id: 'test-column',
+      name: 'Test Column',
+      type: 'BLOB',
+    };
+
+    await createDatasetTable({
+      dataset,
+      columns: [column],
+    });
+
+    await clearDatasetTable({
+      dataset,
+    });
+
+    await upsertColumnValues({
+      dataset,
+      column,
+      values: [[1, new Uint8Array([1, 2, 3])]],
+    });
+
+    await connectAndClose(async (db) => {
+      const tableName = getDatasetTableName(dataset);
+      const columnName = getColumnName(column).replace(/"/g, '');
+
+      const result = await db.run(`SELECT * FROM ${tableName}`);
+      const rows = await result.getRowObjects();
+
+      expect(rows.length).toEqual(1);
+
+      expect(rows).toEqual([
+        {
+          [columnName]: new DuckDBBlobValue(
+            Buffer.from(new Uint8Array([1, 2, 3])),
+          ),
+          rowIdx: 1n,
+        },
+      ]);
+    });
+  });
 });

src/services/repository/tables/insert-column-values.ts

@@ -1,5 +1,5 @@
 import { connectAndClose } from '~/services/db/duckdb';
-import { escapeValue, getColumnName, getDatasetTableName } from './utils';
+import { getColumnName, getDatasetTableName, sanitizeValue } from './utils';
 
 export const upsertColumnValuesFromGenerator = async ({
   dataset,
@@ -24,21 +24,26 @@ export const upsertColumnValuesFromGenerator = async ({
     const generator = valuesGenerator();
 
     for await (const [idx, value] of generator) {
-      const result = await db.run(`
-        SELECT * FROM ${tableName} WHERE rowIdx = ${idx} LIMIT 1;
-      `);
-
+      const result = await db.run(
+        `SELECT * FROM ${tableName} WHERE rowIdx = ${idx} LIMIT 1;`,
+      );
       if (result.rowCount > 0) {
         // Update existing row
-        await db.run(`
-          UPDATE ${tableName} SET ${columnName} = ${escapeValue(value)} WHERE rowIdx = ${idx};
-        `);
+        await db.run(
+          `
+          UPDATE ${tableName} SET ${columnName} = ? WHERE rowIdx = ${idx};
+        `,
+          [sanitizeValue(value)],
+        );
       } else {
         // Insert new row
-        await db.run(`
+        await db.run(
+          `
         INSERT INTO ${tableName} (rowIdx, ${columnName})
-        VALUES (${idx}, ${escapeValue(value)});
-      `);
+        VALUES (${idx}, ?);
+      `,
+          [sanitizeValue(value)],
+        );
       }
     }
   });

src/services/repository/tables/utils.ts

@@ -1,3 +1,5 @@
+import { blobValue } from '@duckdb/node-api';
+
 export const getDatasetTableName = (dataset: { id: string }) => {
   return `"${dataset.id}"`;
 };
@@ -10,14 +12,9 @@ export const getColumnName = (column: { id: string }) => {
   return `"${column.id}"`;
 };
 
-export const escapeValue = (value: any) => {
-  if (value === undefined) return null;
-  if (typeof value === 'string') return `$tag$${value}$tag$`;
-  if (value instanceof Uint8Array) {
-    // TODO: Handle Uint8Array without converting to string
-    const base64Value = Buffer.from(value).toString('base64');
-    return `from_base64('${base64Value}')`;
-  }
-
+export const sanitizeValue = (value: any) => {
+  if (value === undefined || value === null) return null;
+  if (typeof value === 'number' && !Number.isFinite(value)) return null;
+  if (value instanceof Uint8Array) return blobValue(value);
   return value;
 };