Uh oh!
There was an error while loading. Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork 58
Joins3#686
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Uh oh!
There was an error while loading. Please reload this page.
Joins3 #686
Changes from all commits
13beed1966631b8004014c7af565a87eed393d414e35f73e6fc83d9bc5c8010f4bddd49c85f4ef99eba73c6101f6276e3be7a56b5558820b778d8da4a1c539f2007073ca3335ab49c0dc44bee57bc1fe9608e5eca0ca81dad0c884601db102de99c0c2a4ba1ba657456bde5abf41ee3567f1bbb1fff4425a21d100d0f591e38cfcc71a45b18c882dca965c71026ec5ea7f9a2d22c108d8caa65f93e7265bd4387a785e0c1bf293fc1f1ea34ccbb984f807737651a24c7d0fe4f55e752c1de5d05345b251ab077139421014daa635bc15a69bf5e717e30d8f870f3e6a96649bd97e837ca311555c1346015fd05e507fea0b3ce0bf8f0ef44d840b9aae3c4db4aa681979e18746adfd5c3c2e0cd917d99f75ffb9ea43770ab045861459d9107831c25abbf4219b106da412f2a64a735e0d3c854fddd4e85d80a1faa1d2796e41cc6d6c45d8e25b438259ba58a25e099596321e46870a4b5c16c822e02d269df7ae73ccb814c1a9032c6a427a458f688ae747dce3eb517668f563d7953afd34c390334d4caf632aa3f922f92e3dcb4263c418511f51ca0ff42c411dd15243d0d0e10679c278708532739d66892ba2962File filter
Filter by extension
Conversations
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Uh oh!
There was an error while loading. Please reload this page.
Diff view
Diff view
There are no files selected for viewing
Large diffs are not rendered by default.
Uh oh!
There was an error while loading. Please reload this page.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -13,6 +13,8 @@ | ||
| use Utopia\Database\Exception\Truncate as TruncateException; | ||
| use Utopia\Database\Helpers\ID; | ||
| use Utopia\Database\Query; | ||
| use Utopia\Database\QueryContext; | ||
| use Utopia\Database\Validator\Authorization; | ||
| class MariaDB extends SQL | ||
| { | ||
| @@ -56,7 +58,7 @@ public function delete(string $name): bool | ||
| $sql = "DROP DATABASE `{$name}`;"; | ||
| $sql = $this->trigger(Database::EVENT_DATABASE_DELETE, $sql); | ||
| var_dump($sql); | ||
| return $this->getPDO() | ||
| ->prepare($sql) | ||
| ->execute(); | ||
| @@ -1454,11 +1456,14 @@ protected function handleSpatialQueries(Query $query, array &$binds, string $att | ||
| protected function getSQLCondition(Query $query, array &$binds, array $attributes = []): string | ||
| { | ||
| $query->setAttribute($this->getInternalKeyForAttribute($query->getAttribute())); | ||
| $query->setAttributeRight($this->getInternalKeyForAttribute($query->getAttributeRight())); | ||
| $attribute = $query->getAttribute(); | ||
| $attribute = $this->filter($attribute); | ||
| $attribute = $this->quote($attribute); | ||
| $alias = $this->quote(Query::DEFAULT_ALIAS); | ||
| $alias = $query->getAlias(); | ||
| $alias = $this->filter($alias); | ||
| $alias = $this->quote($alias); | ||
| $placeholder = ID::unique(); | ||
| $attributeType = $this->getAttributeType($query->getAttribute(), $attributes); | ||
| @@ -1502,6 +1507,12 @@ protected function getSQLCondition(Query $query, array &$binds, array $attribute | ||
| return "{$alias}.{$attribute} NOT BETWEEN :{$placeholder}_0 AND :{$placeholder}_1"; | ||
| case Query::TYPE_RELATION_EQUAL: | ||
| $attributeRight = $this->quote($this->filter($query->getAttributeRight())); | ||
| $aliasRight = $this->quote($query->getRightAlias()); | ||
| return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}"; | ||
Comment on lines
+1510
to
+1515
Contributor There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Sanitize right-hand alias in relation-equality SQL. aliasRight is quoted but not filtered; filter it like the left alias to prevent malformed aliases or injection. Apply: - case Query::TYPE_RELATION_EQUAL:- $attributeRight = $this->quote($this->filter($query->getAttributeRight()));- $aliasRight = $this->quote($query->getRightAlias());- return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}";+ case Query::TYPE_RELATION_EQUAL:+ $attributeRight = $this->quote($this->filter($query->getAttributeRight()));+ $aliasRight = $this->quote($this->filter($query->getRightAlias()));+ return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}";🤖 Prompt for AI Agents | ||
| case Query::TYPE_IS_NULL: | ||
| case Query::TYPE_IS_NOT_NULL: | ||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -15,6 +15,8 @@ | ||||||||||||||||||||||
| use Utopia\Database\Exception\Truncate as TruncateException; | ||||||||||||||||||||||
| use Utopia\Database\Helpers\ID; | ||||||||||||||||||||||
| use Utopia\Database\Query; | ||||||||||||||||||||||
| use Utopia\Database\QueryContext; | ||||||||||||||||||||||
| use Utopia\Database\Validator\Authorization; | ||||||||||||||||||||||
| class Postgres extends SQL | ||||||||||||||||||||||
| { | ||||||||||||||||||||||
| @@ -1556,10 +1558,13 @@ protected function handleSpatialQueries(Query $query, array &$binds, string $att | ||||||||||||||||||||||
| protected function getSQLCondition(Query $query, array &$binds, array $attributes = []): string | ||||||||||||||||||||||
| { | ||||||||||||||||||||||
| $query->setAttribute($this->getInternalKeyForAttribute($query->getAttribute())); | ||||||||||||||||||||||
| $query->setAttributeRight($this->getInternalKeyForAttribute($query->getAttributeRight())); | ||||||||||||||||||||||
| $attribute = $this->filter($query->getAttribute()); | ||||||||||||||||||||||
| $attribute = $this->quote($attribute); | ||||||||||||||||||||||
| $alias = $this->quote(Query::DEFAULT_ALIAS); | ||||||||||||||||||||||
| $alias = $query->getAlias(); | ||||||||||||||||||||||
| $alias = $this->filter($alias); | ||||||||||||||||||||||
| $alias = $this->quote($alias); | ||||||||||||||||||||||
| $placeholder = ID::unique(); | ||||||||||||||||||||||
| $attributeType = $this->getAttributeType($query->getAttribute(), $attributes); | ||||||||||||||||||||||
| @@ -1599,6 +1604,12 @@ protected function getSQLCondition(Query $query, array &$binds, array $attribute | ||||||||||||||||||||||
| $binds[":{$placeholder}_1"] = $query->getValues()[1]; | ||||||||||||||||||||||
| return "{$alias}.{$attribute} NOT BETWEEN :{$placeholder}_0 AND :{$placeholder}_1"; | ||||||||||||||||||||||
| case Query::TYPE_RELATION_EQUAL: | ||||||||||||||||||||||
| $attributeRight = $this->quote($this->filter($query->getAttributeRight())); | ||||||||||||||||||||||
| $aliasRight = $this->quote($query->getRightAlias()); | ||||||||||||||||||||||
| return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}"; | ||||||||||||||||||||||
Comment on lines
+1607
to
+1612
Contributor There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Sanitize right alias to prevent malformed identifiers. getRightAlias() is quoted but not filtered; filter() should precede quote() as with the left alias. Apply this fix: case Query::TYPE_RELATION_EQUAL:
$attributeRight = $this->quote($this->filter($query->getAttributeRight()));
- $aliasRight = $this->quote($query->getRightAlias());+ $aliasRight = $this->quote($this->filter($query->getRightAlias()));
return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}";📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents | ||||||||||||||||||||||
| case Query::TYPE_IS_NULL: | ||||||||||||||||||||||
| case Query::TYPE_IS_NOT_NULL: | ||||||||||||||||||||||
| return "{$alias}.{$attribute} {$this->getSQLOperator($query->getMethod())}"; | ||||||||||||||||||||||
| @@ -1629,6 +1640,7 @@ protected function getSQLCondition(Query $query, array &$binds, array $attribute | ||||||||||||||||||||||
| Query::TYPE_NOT_ENDS_WITH => '%' . $this->escapeWildcards($value), | ||||||||||||||||||||||
| Query::TYPE_CONTAINS => ($query->onArray()) ? \json_encode($value) : '%' . $this->escapeWildcards($value) . '%', | ||||||||||||||||||||||
| Query::TYPE_NOT_CONTAINS => ($query->onArray()) ? \json_encode($value) : '%' . $this->escapeWildcards($value) . '%', | ||||||||||||||||||||||
| //Query::TYPE_SEARCH => $this->getFulltextValue($value), | ||||||||||||||||||||||
| default => $value | ||||||||||||||||||||||
| }; | ||||||||||||||||||||||
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remove debug var_dump in production path.
Leaking SQL to stdout/stderr from delete() is a correctness and security issue; it also pollutes test output.
Apply:
- var_dump($sql);📝 Committable suggestion
🤖 Prompt for AI Agents