-
Notifications
You must be signed in to change notification settings - Fork 55
Joins3 #686
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Joins3 #686
Changes from all commits
13beed1
966631b
8004014
c7af565
a87eed3
93d414e
35f73e6
fc83d9b
c5c8010
f4bddd4
9c85f4e
f99eba7
3c6101f
6276e3b
e7a56b5
558820b
778d8da
4a1c539
f200707
3ca3335
ab49c0d
c44bee5
7bc1fe9
608e5ec
a0ca81d
ad0c884
601db10
2de99c0
c2a4ba1
ba65745
6bde5ab
f41ee35
67f1bbb
1fff442
5a21d10
0d0f591
e38cfcc
71a45b1
8c882dc
a965c71
026ec5e
a7f9a2d
22c108d
8caa65f
93e7265
bd4387a
785e0c1
bf293fc
1f1ea34
ccbb984
f807737
651a24c
7d0fe4f
55e752c
1de5d05
345b251
ab07713
9421014
daa635b
c15a69b
f5e717e
30d8f87
0f3e6a9
6649bd9
7e837ca
311555c
1346015
fd05e50
7fea0b3
ce0bf8f
0ef44d8
40b9aae
3c4db4a
a681979
e18746a
dfd5c3c
2e0cd91
7d99f75
ffb9ea4
3770ab0
4586145
9d91078
31c25ab
bf4219b
106da41
2f2a64a
735e0d3
c854fdd
d4e85d8
0a1faa1
d2796e4
1cc6d6c
45d8e25
b438259
ba58a25
e099596
321e468
70a4b5c
16c822e
02d269d
f7ae73c
cb814c1
a9032c6
a427a45
8f688ae
747dce3
eb51766
8f563d7
953afd3
4c39033
4d4caf6
32aa3f9
22f92e3
dcb4263
c418511
f51ca0f
f42c411
dd15243
d0d0e10
679c278
7085327
39d6689
2ba2962
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Large diffs are not rendered by default.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -13,6 +13,8 @@ | |
| use Utopia\Database\Exception\Truncate as TruncateException; | ||
| use Utopia\Database\Helpers\ID; | ||
| use Utopia\Database\Query; | ||
| use Utopia\Database\QueryContext; | ||
| use Utopia\Database\Validator\Authorization; | ||
|
|
||
| class MariaDB extends SQL | ||
| { | ||
|
|
@@ -56,7 +58,7 @@ public function delete(string $name): bool | |
| $sql = "DROP DATABASE `{$name}`;"; | ||
|
|
||
| $sql = $this->trigger(Database::EVENT_DATABASE_DELETE, $sql); | ||
|
|
||
| var_dump($sql); | ||
| return $this->getPDO() | ||
| ->prepare($sql) | ||
| ->execute(); | ||
|
|
@@ -1454,11 +1456,14 @@ protected function handleSpatialQueries(Query $query, array &$binds, string $att | |
| protected function getSQLCondition(Query $query, array &$binds, array $attributes = []): string | ||
| { | ||
| $query->setAttribute($this->getInternalKeyForAttribute($query->getAttribute())); | ||
| $query->setAttributeRight($this->getInternalKeyForAttribute($query->getAttributeRight())); | ||
|
|
||
| $attribute = $query->getAttribute(); | ||
| $attribute = $this->filter($attribute); | ||
| $attribute = $this->quote($attribute); | ||
| $alias = $this->quote(Query::DEFAULT_ALIAS); | ||
| $alias = $query->getAlias(); | ||
| $alias = $this->filter($alias); | ||
| $alias = $this->quote($alias); | ||
| $placeholder = ID::unique(); | ||
|
|
||
| $attributeType = $this->getAttributeType($query->getAttribute(), $attributes); | ||
|
|
@@ -1502,6 +1507,12 @@ protected function getSQLCondition(Query $query, array &$binds, array $attribute | |
|
|
||
| return "{$alias}.{$attribute} NOT BETWEEN :{$placeholder}_0 AND :{$placeholder}_1"; | ||
|
|
||
| case Query::TYPE_RELATION_EQUAL: | ||
| $attributeRight = $this->quote($this->filter($query->getAttributeRight())); | ||
| $aliasRight = $this->quote($query->getRightAlias()); | ||
|
|
||
| return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}"; | ||
|
|
||
|
Comment on lines
+1510
to
+1515
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Sanitize right-hand alias in relation-equality SQL. aliasRight is quoted but not filtered; filter it like the left alias to prevent malformed aliases or injection. Apply: - case Query::TYPE_RELATION_EQUAL:
- $attributeRight = $this->quote($this->filter($query->getAttributeRight()));
- $aliasRight = $this->quote($query->getRightAlias());
- return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}";
+ case Query::TYPE_RELATION_EQUAL:
+ $attributeRight = $this->quote($this->filter($query->getAttributeRight()));
+ $aliasRight = $this->quote($this->filter($query->getRightAlias()));
+ return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}";🤖 Prompt for AI Agents |
||
| case Query::TYPE_IS_NULL: | ||
| case Query::TYPE_IS_NOT_NULL: | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -15,6 +15,8 @@ | |||||||||||||||||||||
| use Utopia\Database\Exception\Truncate as TruncateException; | ||||||||||||||||||||||
| use Utopia\Database\Helpers\ID; | ||||||||||||||||||||||
| use Utopia\Database\Query; | ||||||||||||||||||||||
| use Utopia\Database\QueryContext; | ||||||||||||||||||||||
| use Utopia\Database\Validator\Authorization; | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| class Postgres extends SQL | ||||||||||||||||||||||
| { | ||||||||||||||||||||||
|
|
@@ -1556,10 +1558,13 @@ protected function handleSpatialQueries(Query $query, array &$binds, string $att | |||||||||||||||||||||
| protected function getSQLCondition(Query $query, array &$binds, array $attributes = []): string | ||||||||||||||||||||||
| { | ||||||||||||||||||||||
| $query->setAttribute($this->getInternalKeyForAttribute($query->getAttribute())); | ||||||||||||||||||||||
| $query->setAttributeRight($this->getInternalKeyForAttribute($query->getAttributeRight())); | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| $attribute = $this->filter($query->getAttribute()); | ||||||||||||||||||||||
| $attribute = $this->quote($attribute); | ||||||||||||||||||||||
| $alias = $this->quote(Query::DEFAULT_ALIAS); | ||||||||||||||||||||||
| $alias = $query->getAlias(); | ||||||||||||||||||||||
| $alias = $this->filter($alias); | ||||||||||||||||||||||
| $alias = $this->quote($alias); | ||||||||||||||||||||||
| $placeholder = ID::unique(); | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| $attributeType = $this->getAttributeType($query->getAttribute(), $attributes); | ||||||||||||||||||||||
|
|
@@ -1599,6 +1604,12 @@ protected function getSQLCondition(Query $query, array &$binds, array $attribute | |||||||||||||||||||||
| $binds[":{$placeholder}_1"] = $query->getValues()[1]; | ||||||||||||||||||||||
| return "{$alias}.{$attribute} NOT BETWEEN :{$placeholder}_0 AND :{$placeholder}_1"; | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| case Query::TYPE_RELATION_EQUAL: | ||||||||||||||||||||||
| $attributeRight = $this->quote($this->filter($query->getAttributeRight())); | ||||||||||||||||||||||
| $aliasRight = $this->quote($query->getRightAlias()); | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}"; | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
|
Comment on lines
+1607
to
+1612
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Sanitize right alias to prevent malformed identifiers. getRightAlias() is quoted but not filtered; filter() should precede quote() as with the left alias. Apply this fix: case Query::TYPE_RELATION_EQUAL:
$attributeRight = $this->quote($this->filter($query->getAttributeRight()));
- $aliasRight = $this->quote($query->getRightAlias());
+ $aliasRight = $this->quote($this->filter($query->getRightAlias()));
return "{$alias}.{$attribute}={$aliasRight}.{$attributeRight}";📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||
| case Query::TYPE_IS_NULL: | ||||||||||||||||||||||
| case Query::TYPE_IS_NOT_NULL: | ||||||||||||||||||||||
| return "{$alias}.{$attribute} {$this->getSQLOperator($query->getMethod())}"; | ||||||||||||||||||||||
|
|
@@ -1629,6 +1640,7 @@ protected function getSQLCondition(Query $query, array &$binds, array $attribute | |||||||||||||||||||||
| Query::TYPE_NOT_ENDS_WITH => '%' . $this->escapeWildcards($value), | ||||||||||||||||||||||
| Query::TYPE_CONTAINS => ($query->onArray()) ? \json_encode($value) : '%' . $this->escapeWildcards($value) . '%', | ||||||||||||||||||||||
| Query::TYPE_NOT_CONTAINS => ($query->onArray()) ? \json_encode($value) : '%' . $this->escapeWildcards($value) . '%', | ||||||||||||||||||||||
| //Query::TYPE_SEARCH => $this->getFulltextValue($value), | ||||||||||||||||||||||
| default => $value | ||||||||||||||||||||||
| }; | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
|
|
||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remove debug var_dump in production path.
Leaking SQL to stdout/stderr from delete() is a correctness and security issue; it also pollutes test output.
Apply:
- var_dump($sql);📝 Committable suggestion
🤖 Prompt for AI Agents