From bc806313b115dc7f500f881b54f7ba6933cfbf98 Mon Sep 17 00:00:00 2001
From: asepharyana <superaseph@gmail.com>
Date: Tue, 7 Jul 2026 06:04:17 +0700
Subject: [PATCH] fix: use safe LIKE prefix matching instead of non-character
 range

---
 src/db/files-ext.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/db/files-ext.ts b/src/db/files-ext.ts
index 025eb9d..09bce9b 100644
--- a/src/db/files-ext.ts
+++ b/src/db/files-ext.ts
@@ -55,6 +55,8 @@ const mapDbRowToS3Record = (row: Record<string, unknown>): S3FileRecord => {
   };
 };
 
+const escapeLike = (s: string): string => s.replace(/[%_\\]/g, '\\$&');
+
 export const listObjectsByPrefix = async (
   bucketId: string,
   prefix: string,
@@ -63,7 +65,7 @@ export const listObjectsByPrefix = async (
   startAfter: string | null,
 ): Promise<{ objects: S3FileRecord[]; prefixes: string[] }> => {
   let query = prefix
-    ? sql`SELECT * FROM files WHERE bucket_id = ${bucketId}::uuid AND is_deleted = false AND s3_key >= ${prefix} AND s3_key < ${`${prefix}￿`}`
+    ? sql`SELECT * FROM files WHERE bucket_id = ${bucketId}::uuid AND is_deleted = false AND s3_key LIKE ${`${escapeLike(prefix)}%`}`
     : sql`SELECT * FROM files WHERE bucket_id = ${bucketId}::uuid AND is_deleted = false`;
 
   if (startAfter) {