fix(query-generator): regexp operator

lib/dialects/abstract/query-generator.js

@@ -2420,10 +2420,6 @@ const QueryGenerator = {
       }
     }
 
-    if (comparator.indexOf(this.OperatorMap[Op.regexp]) !== -1) {
-      return this._joinKeyValue(key, `'${value}'`, comparator, options.prefix);
-    }
-
     if (value === null && comparator === this.OperatorMap[Op.eq]) {
       return this._joinKeyValue(key, this.escape(value, field, escapeOptions), this.OperatorMap[Op.is], options.prefix);
     } else if (value === null && comparator === this.OperatorMap[Op.ne]) {

test/integration/model/attributes/operators.test.js → test/integration/operators.test.js

 'use strict';
 
 const chai = require('chai'),
-  Sequelize = require('../../../../index'),
+  Sequelize = require('../../index'),
+  Op = Sequelize.Op,
   Promise = Sequelize.Promise,
   expect = chai.expect,
-  Support = require(__dirname + '/../../support'),
-  DataTypes = require(__dirname + '/../../../../lib/data-types'),
+  Support = require(__dirname + '/../support'),
+  DataTypes = require(__dirname + '/../../lib/data-types'),
   dialect = Support.getTestDialect();
 
-describe(Support.getTestDialectTeaser('Model'), () => {
-  describe('attributes', () => {
-    describe('operators', () => {
+describe(Support.getTestDialectTeaser('Operators'), () => {
   describe('REGEXP', () => {
     beforeEach(function() {
-          const queryInterface = this.sequelize.getQueryInterface();
-
       this.User = this.sequelize.define('user', {
         id: {
           type: DataTypes.INTEGER,
@@ -33,7 +30,7 @@ describe(Support.getTestDialectTeaser('Model'), () => {
       });
 
       return Promise.all([
-            queryInterface.createTable('users', {
+        this.sequelize.getQueryInterface().createTable('users', {
           userId: {
             type: DataTypes.INTEGER,
             allowNull: false,
@@ -48,16 +45,15 @@ describe(Support.getTestDialectTeaser('Model'), () => {
     });
 
     if (dialect === 'mysql' || dialect === 'postgres') {
+      describe('case sensitive', () => {
         it('should work with a regexp where', function() {
-            const self = this;
-
           return this.User.create({
             name: 'Foobar'
           }).then(() => {
-              return self.User.find({
+            return this.User.find({
               where: {
                 name: {
-                    $regexp: '^Foo'
+                  [Op.regexp]: '^Foo'
                 }
               }
             });
@@ -67,15 +63,13 @@ describe(Support.getTestDialectTeaser('Model'), () => {
         });
 
         it('should work with a not regexp where', function() {
-            const self = this;
-
           return this.User.create({
             name: 'Foobar'
           }).then(() => {
-              return self.User.find({
+            return this.User.find({
               where: {
                 name: {
-                    $notRegexp: '^Foo'
+                  [Op.notRegexp]: '^Foo'
                 }
               }
             });
@@ -84,7 +78,38 @@ describe(Support.getTestDialectTeaser('Model'), () => {
           });
         });
 
+        it('should properly escape regular expressions', function() {
+          return this.User.bulkCreate([{
+            name: 'John'
+          }, {
+            name: 'Bob'
+          }]).then(() => {
+            return this.User.findAll({
+              where: {
+                name: {
+                  [Op.notRegexp]: "Bob'; drop table users --"
+                }
+              }
+            });
+          }).then(() => {
+            return this.User.findAll({
+              where: {
+                name: {
+                  [Op.regexp]: "Bob'; drop table users --"
+                }
+              }
+            });
+          }).then(() => {
+            return this.User.findAll();
+          }).then(users => {
+            expect(users).length(2);
+          });
+        });
+      });
+    }
+
     if (dialect === 'postgres') {
+      describe('case insensitive', () => {
         it('should work with a case-insensitive regexp where', function() {
           const self = this;
 
@@ -94,7 +119,7 @@ describe(Support.getTestDialectTeaser('Model'), () => {
             return self.User.find({
               where: {
                 name: {
-                      $iRegexp: '^foo'
+                  [Op.iRegexp]: '^foo'
                 }
               }
             });
@@ -112,7 +137,7 @@ describe(Support.getTestDialectTeaser('Model'), () => {
             return self.User.find({
               where: {
                 name: {
-                      $notIRegexp: '^foo'
+                  [Op.notIRegexp]: '^foo'
                 }
               }
             });
@@ -120,9 +145,35 @@ describe(Support.getTestDialectTeaser('Model'), () => {
             expect(user).to.not.be.ok;
           });
         });
+
+        it('should properly escape regular expressions', function() {
+          return this.User.bulkCreate([{
+            name: 'John'
+          }, {
+            name: 'Bob'
+          }]).then(() => {
+            return this.User.findAll({
+              where: {
+                name: {
+                  [Op.iRegexp]: "Bob'; drop table users --"
                 }
               }
             });
+          }).then(() => {
+            return this.User.findAll({
+              where: {
+                name: {
+                  [Op.notIRegexp]: "Bob'; drop table users --"
+                }
+              }
             });
+          }).then(() => {
+            return this.User.findAll();
+          }).then(users => {
+            expect(users).length(2);
+          });
+        });
+      });
+    }
   });
 });

test/unit/sql/where.test.js

@@ -1037,7 +1037,7 @@ suite(Support.getTestDialectTeaser('SQL'), () => {
         testsql('newline', {
           $regexp: '^new\nline$'
         }, {
-          mysql: "`newline` REGEXP '^new\nline$'",
+          mysql: "`newline` REGEXP '^new\\nline$'",
           postgres: '"newline" ~ \'^new\nline$\''
         });
       });
@@ -1055,7 +1055,7 @@ suite(Support.getTestDialectTeaser('SQL'), () => {
         testsql('newline', {
           $notRegexp: '^new\nline$'
         }, {
-          mysql: "`newline` NOT REGEXP '^new\nline$'",
+          mysql: "`newline` NOT REGEXP '^new\\nline$'",
           postgres: '"newline" !~ \'^new\nline$\''
         });
       });