amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-05-19 02:15:36 +00:00
Code Issues Projects Releases Wiki Activity

fix(core): escape quotes before sending SQL queries

Browse Source 
Fixes #5010
This commit is contained in:
Francis Lachapelle
2020-04-27 17:13:28 -04:00
parent 04a6217512
commit 09c76b3649
3 changed files with 99 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SOPE/GDLContentStore/EOQualifier+GCS.h
+1 -1
View File
@@ -28,7 +28,7 @@
@interface EOQualifier(GCS)
- (void)_gcsAppendToString:(NSMutableString *)_ms;
- (void) _gcsAppendToString: (NSMutableString *) _ms;
@end
SOPE/GDLContentStore/EOQualifier+GCS.m
+36 -25
View File
@@ -32,8 +32,8 @@
@implementation EOQualifier(GCS)
- (void)_appendAndQualifier:(EOAndQualifier *)_q
toString:(NSMutableString *)_ms
- (void) _appendAndQualifier: (EOAndQualifier *) _q
toString: (NSMutableString *) _ms
{
// TODO: move to EOQualifier category
NSArray *qs;
@@ -46,12 +46,12 @@
for (i = 0; i < count; i++) {
if (i != 0) [_ms appendString:@" AND "];
if (count > 1) [_ms appendString:@"("];
[[qs objectAtIndex:i] _gcsAppendToString:_ms];
[[qs objectAtIndex:i] _gcsAppendToString: _ms];
if (count > 1) [_ms appendString:@")"];
}
}
- (void)_appendOrQualifier:(EOAndQualifier *)_q
toString:(NSMutableString *)_ms
- (void)_appendOrQualifier: (EOAndQualifier *) _q
toString: (NSMutableString *) _ms
{
// TODO: move to EOQualifier category
NSArray *qs;
@@ -64,21 +64,21 @@
for (i = 0; i < count; i++) {
if (i != 0) [_ms appendString:@" OR "];
if (count > 1) [_ms appendString:@"("];
[[qs objectAtIndex:i] _gcsAppendToString:_ms];
[[qs objectAtIndex:i] _gcsAppendToString: _ms];
if (count > 1) [_ms appendString:@")"];
}
}
- (void)_appendNotQualifier:(EONotQualifier *)_q
toString:(NSMutableString *)_ms
- (void)_appendNotQualifier: (EONotQualifier *)_q
toString:(NSMutableString *) _ms
{
[_ms appendString:@" NOT ("];
[[_q qualifier] _gcsAppendToString:_ms];
[[_q qualifier] _gcsAppendToString: _ms];
[_ms appendString:@")"];
}
- (void)_appendKeyValueQualifier:(EOKeyValueQualifier *)_q
toString:(NSMutableString *)_ms
- (void) _appendKeyValueQualifier: (EOKeyValueQualifier *) _q
toString: (NSMutableString *) _ms
{
id val;
NSString *qKey, *qOperator, *qValue, *qFormat;
@@ -115,10 +115,13 @@
qOperator = @"=";
}
if ([val isKindOfClass:[NSNumber class]])
if ([val isKindOfClass: [NSNumber class]])
qValue = [val stringValue];
else if ([val isKindOfClass:[NSString class]]) {
qValue = [NSString stringWithFormat: @"'%@'", [val stringByReplacingString: @"'" withString: @"\\'"]];
else if ([val isKindOfClass: [NSString class]]) {
if ([val hasPrefix: @"'"])
qValue = val;
else
qValue = [NSString stringWithFormat: @"'%@'", val];
}
else {
qValue = @"NULL";
@@ -151,23 +154,31 @@
[_ms appendFormat: qFormat, qKey, qOperator, qValue];
}
- (void)_appendQualifier:(EOQualifier *)_q toString:(NSMutableString *)_ms {
- (void) _appendQualifier: (EOQualifier *) _q
toString: (NSMutableString *) _ms
{
if (_q == nil) return;
if ([_q isKindOfClass:[EOAndQualifier class]])
[self _appendAndQualifier:(id)_q toString:_ms];
else if ([_q isKindOfClass:[EOOrQualifier class]])
[self _appendOrQualifier:(id)_q toString:_ms];
else if ([_q isKindOfClass:[EOKeyValueQualifier class]])
[self _appendKeyValueQualifier:(id)_q toString:_ms];
else if ([_q isKindOfClass:[EONotQualifier class]])
[self _appendNotQualifier:(id)_q toString:_ms];
if ([_q isKindOfClass: [EOAndQualifier class]])
[self _appendAndQualifier: (id)_q
toString: _ms];
else if ([_q isKindOfClass: [EOOrQualifier class]])
[self _appendOrQualifier: (id)_q
toString:_ms];
else if ([_q isKindOfClass: [EOKeyValueQualifier class]])
[self _appendKeyValueQualifier: (id)_q
toString:_ms];
else if ([_q isKindOfClass: [EONotQualifier class]])
[self _appendNotQualifier: (id)_q
toString:_ms];
else
[self errorWithFormat:@"unknown qualifier: %@", _q];
}
- (void)_gcsAppendToString:(NSMutableString *)_ms {
[self _appendQualifier:self toString:_ms];
- (void) _gcsAppendToString: (NSMutableString *) _ms
{
[self _appendQualifier: self
toString: _ms];
}
@end /* EOQualifier(GCS) */
SOPE/GDLContentStore/GCSFolder.m
+62
View File
@@ -380,10 +380,31 @@ static GCSStringFormatter *stringFormatter = nil;
- (NSString *) _sqlForQualifier: (EOQualifier *) qualifier
{
static EOAdaptor *adaptor = nil;
NSMutableString *ms;
if (qualifier)
{
if (!adaptor)
{
EOAdaptorContext *adaptorCtx;
EOAdaptorChannel *channel;
channel = [self acquireStoreChannel];
adaptorCtx = [channel adaptorContext];
adaptor = [adaptorCtx adaptor];
}
if ([qualifier isKindOfClass: [EOAndQualifier class]])
[self _findQualifiers: (id)qualifier withAdaptor: adaptor];
else if ([qualifier isKindOfClass:[EOOrQualifier class]])
[self _findQualifiers: (id)qualifier withAdaptor: adaptor];
else if ([qualifier isKindOfClass:[EOKeyValueQualifier class]])
[self _formatQualifierValue: (id)qualifier withAdaptor: adaptor];
else if ([qualifier isKindOfClass:[EONotQualifier class]])
[self _formatQualifierValue: [(id)qualifier qualifier] withAdaptor: adaptor];
else
[self errorWithFormat:@"unknown qualifier: %@", qualifier];
ms = [NSMutableString stringWithCapacity:32];
[qualifier _gcsAppendToString: ms];
}
@@ -393,6 +414,47 @@ static GCSStringFormatter *stringFormatter = nil;
return ms;
}
- (void) _findQualifiers: (id) qualifier
withAdaptor: (EOAdaptor *) adaptor
{
NSArray *qs;
unsigned i, count;
if (qualifier == nil) return;
qs = [qualifier qualifiers];
if ((count = [qs count]) == 0)
return;
for (i = 0; i < count; i++) {
id q = [qs objectAtIndex: i];
if ([q isKindOfClass: [EOAndQualifier class]])
[self _findQualifiers: q withAdaptor: adaptor];
else if ([q isKindOfClass:[EOOrQualifier class]])
[self _findQualifiers: q withAdaptor: adaptor];
else if ([q isKindOfClass:[EOKeyValueQualifier class]])
[self _formatQualifierValue: q withAdaptor: adaptor];
else if ([q isKindOfClass:[EONotQualifier class]])
[self _formatQualifierValue: [q qualifier] withAdaptor: adaptor];
else
[self errorWithFormat:@"unknown qualifier: %@", q];
}
}
- (void) _formatQualifierValue: (EOKeyValueQualifier *) qualifier
withAdaptor: (EOAdaptor *) adaptor
{
NSString *field;
EOAttribute *attribute;
NSString *formattedValue;
field = [qualifier key];
attribute = [self _attributeForColumn: field];
formattedValue = [adaptor formatValue: [qualifier value]
forAttribute: attribute];
[qualifier setValue: formattedValue];
}
- (NSString *)_sqlForSortOrderings:(NSArray *)_so {
NSMutableString *sql;
unsigned i, count;