[PerryLink]

Resolves #3893

assertSafeQuery() validated ORDER BY column names with /^("[a-zA-Z_]+"|[a-zA-Z_]+) (ASC|DESC)$/, which rejects any schema field containing a digit, while the SELECT column checks at the top of the same function use /^"[a-z_]\w+"$/i and accept them. Server/SSR queries through queryCollection('docs').order('publishedAt2', 'DESC') therefore returned a 500 (Invalid query: ORDER BY clause must contain valid column names followed by ASC or DESC), even though .where('publishedAt2', ...) and .select('publishedAt2') worked and the client WASM path (which bypasses the validator) sorted correctly.

Widen the ORDER BY pattern the same way #3100 widened it for uppercase names: [a-zA-Z_]\w* so digits are allowed after the first character, matching what collectionQueryBuilder emits for arbitrary zod object keys.

-  if (!_order.every(column => column.match(/^("[a-zA-Z_]+"|[a-zA-Z_]+) (ASC|DESC)$/))) {
+  if (!_order.every(column => column.match(/^("[a-zA-Z_]\w*"|[a-zA-Z_]\w*) (ASC|DESC)$/))) {

Tests

test/unit/assertSafeQuery.test.ts adds cases for ORDER BY "field1" DESC, ORDER BY id ASC, publishedAt2 DESC, the collectionQueryBuilder output for a digit field, and keeps ORDER BY "a b" DESC rejected.

• before: 3 failed / 101 passed
• after: 104 passed
• test/unit suite: 408 passed, 1 skipped; the only failing file is the pre-existing test/unit/utils.test.ts (imports @nuxt/content/utils from an unbuilt dist), which fails before this change too.
• ESLint clean on the changed files.

[vercel]

@PerryLink is attempting to deploy a commit to the Nuxt Team on Vercel.

A member of the Team first needs to authorize it.

[pkg-pr-new]

npm i https://pkg.pr.new/@nuxt/content@3894

commit: e3895e7

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: bb231546-6ac2-4448-92c0-150fea9eb218

Commits

Reviewing files that changed from the base of the PR and between 3942be4 and e3895e7.

Files selected for processing: 2

• src/runtime/internal/security.ts
• test/unit/assertSafeQuery.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The ORDER BY validation now accepts identifiers with digits after the initial letter or underscore. Tests cover quoted and unquoted digit-containing names, a quoted name with spaces, and a query-builder result ordering by field1.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Severity of issue fixed: Medium

Merge Risk: Low · up to e3895

Sorting by some valid schema field names still fails on the server. The digit-field fix is covered, but this narrower limitation should be addressed or explicitly accepted.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title "fix(query): allow digits in ORDER BY column names" matches the main change. The diff widens the ORDER BY column-name pattern in assertSafeQuery so that digits are allowed after the first ch…
Description check		The description explains the bug, the root cause (the ORDER BY regex rejects digits while the SELECT checks accept them), and the one-line regex change. It also lists the added test cases and the test…
Linked Issues check		[#3893] Directly linked issue #3893 requires that ORDER BY on schema fields containing digits (for example publishedAt2 and h1) passes the server-side assertSafeQuery() validator. The whole-PR d…
Out of Scope Changes check		The whole-PR diff touches only src/runtime/internal/security.ts (one ORDER BY regex line) and test/unit/assertSafeQuery.test.ts (added test cases for digit-containing ORDER BY column names and ret…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.

Full details: Title check

Explanation

The title "fix(query): allow digits in ORDER BY column names" matches the main change. The diff widens the ORDER BY column-name pattern in assertSafeQuery so that digits are allowed after the first character. The title is concise, specific, and follows a conventional commit style.

Full details: Description check

Explanation

The description explains the bug, the root cause (the ORDER BY regex rejects digits while the SELECT checks accept them), and the one-line regex change. It also lists the added test cases and the test results. It relates directly to the changeset.

Full details: Linked Issues check

Explanation

[#3893] Directly linked issue #3893 requires that ORDER BY on schema fields containing digits (for example publishedAt2 and h1) passes the server-side assertSafeQuery() validator. The whole-PR diff (merge base 3942be4 to head e3895e7) changes one line in src/runtime/internal/security.ts. The ORDER BY pattern changes from /^("[a-zA-Z_]+"|[a-zA-Z_]+) (ASC|DESC)$/ to /^("[a-zA-Z_]\w*"|[a-zA-Z_]\w*) (ASC|DESC)$/. At head, the quoted form "publishedAt2" DESC and the unquoted form publishedAt2 DESC both match. h1 DESC also matches. The new pattern still rejects names containing spaces, such as "a b" DESC. The ORDER BY check still runs after the existing SELECT, WHERE, and FROM checks, which are unchanged. The change adds unit test cases for ORDER BY "field1" DESC, ORDER BY id ASC, publishedAt2 DESC, and rejection of "a b" DESC, as described in the PR. I did not run the test suite. The conclusion rests on the regex diff and the file content at head. No non-coding requirements are present in the linked issue.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff touches only src/runtime/internal/security.ts (one ORDER BY regex line) and test/unit/assertSafeQuery.test.ts (added test cases for digit-containing ORDER BY column names and retained rejection of a quoted name with a space). Both changes support objective #3893 directly. The change does not alter SELECT, WHERE, FROM, LIMIT, OFFSET, or comment-handling logic. No unrelated changes were found in the reviewed diff summary or the inspected source.

Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}