[Makisuo]

Fixes #38.

ClickhouseHttpClient sent each parameter as param_pN=String(value). ClickHouse reads a scalar HTTP parameter in the escaped (TabSeparated) format, so:

• a newline, tab, CR or NUL failed with BAD_QUERY_PARAMETER;
• a backslash started an escape sequence: a\\nb arrived as a<LF>b, silently changing the data.

While reproducing this, I found that array parameters were sent as JSON.stringify(value). ClickHouse reads an array parameter as a literal, with no TabSeparated layer, and rejects double-quoted strings, so an array of strings did not bind at all (CANNOT_PARSE_QUOTED_STRING). Arrays are now written as ClickHouse literals (['a\\'b', NULL, 1]), and only their quoted strings are escaped. I checked both layers with curl against ClickHouse 26.8.

Verification

• New live test in tests/clickhouse-http.clickhouse.test.ts round-trips a\nb, a literal a\\nb, double backslashes, a tab, CR, NUL and é é 🙂\n|\t\\n as a scalar and inside an array with it's. It fails on main and passes here (ClickHouse 26.8.2.7).
• bun run typecheck and bun run test (1430 tests): green.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 57 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ffd7285e-f498-4cfc-874f-b4e91d41aebb

Commits

Reviewing files that changed from the base of the PR and between b57faf1 and 790635b.

Files selected for processing: 3

• .changeset/clickhouse-http-param-escaping.md
• src/clickhouse-http/client.ts
• tests/clickhouse-http.clickhouse.test.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[maple-review-bot]

Maple review

🟢 Confidence 10/10 · safe to merge. I exercised the new escaping on adversarial inputs and it round-trips; the live test covers both layers, leaving only the duplicated literal escaping.
_{1 note · tests covered · risk medium}

Rewrites HTTP param serialization in ClickableHttpClient so scalars are TabSeparated-escaped and arrays are sent as ClickHouse literals. The escaping is correct and the live test pins both layers; safe to merge.

• paramValue now escapes scalars as ClickHouse's escaped (TabSeparated) format
• Array params are sent as ClickHouse literals instead of JSON.stringify
• New live test round-trips control characters and backslashes as scalars and arrays

Findings

🔵 Note · F1 · Array elements re-escape ClickHouse strings instead of quoteClickHouseString

maintainability · src/clickhouse-http/client.ts:148

Array elements get their own backslash-and-quote escaping inlined here, while src/sql/sql-fragment.ts:24 already exports escapeClickHouseString for ClickHouse literals — including the ; hex escape added there for gateways that split statements on the raw byte. The two copies must be kept in sync by hand, and a hazard fixed in one is missed by the other.

Import `quoteClickHouseString` from `../sql/index` and use it for the element at line 148, dropping the inline `.replace(/[\\']/g, …)`.

🤖 Prompt to fix this finding with an AI agent

Findings from an automated review of commit 790635ba68fe5307a95b056483d26d050555451c. Verify each one against the current code before changing anything, fix only those that still apply, and keep each fix to the lines it names.

---

F1 · Note · maintainability · src/clickhouse-http/client.ts:148
Array elements re-escape ClickHouse strings instead of `quoteClickHouseString`
Array elements get their own backslash-and-quote escaping inlined here, while `src/sql/sql-fragment.ts:24` already exports `escapeClickHouseString` for ClickHouse literals — including the `;` hex escape added there for gateways that split statements on the raw byte. The two copies must be kept in sync by hand, and a hazard fixed in one is missed by the other.
Suggested fix: Import `quoteClickHouseString` from `../sql/index` and use it for the element at line 148, dropping the inline `.replace(/[\\']/g, …)`.

_{790635b · What was checked, coverage and telemetry details are on the Maple / review check. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}