Skip to content

Commit 332b0ab

Browse files
committed
docs(filters): clarify how to use string maps
I personally struggled with the current description. I hope this reduced wording is more explicit, while re-using explanation from `Ash.Query.filter_input/2`.
1 parent 64afdd9 commit 332b0ab

File tree

1 file changed

+4
-6
lines changed

1 file changed

+4
-6
lines changed

lib/ash/filter/filter.ex

+4-6
Original file line numberDiff line numberDiff line change
@@ -116,12 +116,10 @@ defmodule Ash.Filter do
116116
117117
## Security Concerns
118118
119-
If you are using a map with string keys, it is likely that you are parsing
120-
input. It is important to note that, instead of passing a filter supplied from
121-
an external source directly to `Ash.Query.filter/2`, you should call
122-
`Ash.Filter.parse_input/2`. This ensures that the filter only uses public
123-
attributes, relationships, aggregates and calculations, honors field policies
124-
and any policies on related resources.
119+
Do not pass user input directly to `Ash.Query.filter/2`, it will not be sanitised. Instead use
120+
`Ash.Filter.parse_input/2` or `Ash.Query.filter_input/2`.
121+
122+
See `Ash.Query.filter_input/2` for more information.
125123
126124
## Writing a filter
127125

0 commit comments

Comments
 (0)