From d026b81e56b217ccf3f3806a531d3d08eb299dfa Mon Sep 17 00:00:00 2001
From: ANSHSINGH050404 <114014895+ANSHSINGH050404@users.noreply.github.com>
Date: Mon, 20 Jul 2026 12:23:36 +0530
Subject: [PATCH] fix(webapp): escape single quotes in realtime tags filter

Closes #3739
---
 .server-changes/fix-realtime-tags-sql-escape.md   | 6 ++++++
 apps/webapp/app/services/realtimeClient.server.ts | 5 ++++-
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 .server-changes/fix-realtime-tags-sql-escape.md

diff --git a/.server-changes/fix-realtime-tags-sql-escape.md b/.server-changes/fix-realtime-tags-sql-escape.md
new file mode 100644
index 00000000000..04b81669ec5
--- /dev/null
+++ b/.server-changes/fix-realtime-tags-sql-escape.md
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Hardened realtime run filtering so special characters in tags cannot interfere with the query.
diff --git a/apps/webapp/app/services/realtimeClient.server.ts b/apps/webapp/app/services/realtimeClient.server.ts
index 9797eeebf40..8ec0c5aba1e 100644
--- a/apps/webapp/app/services/realtimeClient.server.ts
+++ b/apps/webapp/app/services/realtimeClient.server.ts
@@ -171,7 +171,10 @@ export class RealtimeClient {
     const whereClauses: string[] = [`"runtimeEnvironmentId"='${environment.id}'`];
 
     if (params.tags) {
-      whereClauses.push(`"runTags" @> ARRAY[${params.tags.map((t) => `'${t}'`).join(",")}]`);
+      // Escape single quotes so user-provided tags cannot break out of the
+      // ARRAY literal (Electric WHERE clause is string-interpolated).
+      const escapedTags = params.tags.map((t) => `'${t.replace(/'/g, "''")}'`).join(",");
+      whereClauses.push(`"runTags" @> ARRAY[${escapedTags}]`);
     }
 
     const createdAtFilter = await this.#calculateCreatedAtFilter(url, params.createdAt);