Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c942a1b

Browse files
taylorotwelltaylorotwell
committed
Make column quoting more robust for greater security when passing an array of user input into update methods.
1 parent c1d343a commit c942a1b

10 files changed

Lines changed: 60 additions & 51 deletions

File tree

‎src/Illuminate/Database/Grammar.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,9 @@ public function wrap($value)
8383
*/
8484
protected function wrapValue($value)
8585
{
86-
return $value !== '*' ? sprintf($this->wrapper, $value) : $value;
86+
if ($value === '*') return $value;
87+
88+
return '"'.str_replace('"', '""', $value).'"';
8789
}
8890

8991
/**

‎src/Illuminate/Database/Query/Grammars/Grammar.php‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,6 @@
55

66
class Grammar extends BaseGrammar {
77

8-
/**
9-
* The keyword identifier wrapper format.
10-
*
11-
* @var string
12-
*/
13-
protected $wrapper = '"%s"';
14-
158
/**
169
* The components that make up a select clause.
1710
*

‎src/Illuminate/Database/Query/Grammars/MySqlGrammar.php‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,6 @@
44

55
class MySqlGrammar extends Grammar {
66

7-
/**
8-
* The keyword identifier wrapper format.
9-
*
10-
* @var string
11-
*/
12-
protected $wrapper = '`%s`';
13-
147
/**
158
* The components that make up a select clause.
169
*
@@ -99,4 +92,17 @@ public function compileUpdate(Builder $query, $values)
9992
return rtrim($sql);
10093
}
10194

95+
/**
96+
* Wrap a single string in keyword identifiers.
97+
*
98+
* @param string $value
99+
* @return string
100+
*/
101+
protected function wrapValue($value)
102+
{
103+
if ($value === '*') return $value;
104+
105+
return '`'.str_replace('`', '``', $value).'`';
106+
}
107+
102108
}

‎src/Illuminate/Database/Query/Grammars/SqlServerGrammar.php‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,6 @@ class SqlServerGrammar extends Grammar {
1515
'&', '&=', '|', '|=', '^', '^=',
1616
);
1717

18-
/**
19-
* The keyword identifier wrapper format.
20-
*
21-
* @var string
22-
*/
23-
protected $wrapper = '[%s]';
24-
2518
/**
2619
* Compile a select query into SQL.
2720
*
@@ -217,4 +210,17 @@ public function getDateFormat()
217210
return 'Y-m-d H:i:s.000';
218211
}
219212

213+
/**
214+
* Wrap a single string in keyword identifiers.
215+
*
216+
* @param string $value
217+
* @return string
218+
*/
219+
protected function wrapValue($value)
220+
{
221+
if ($value === '*') return $value;
222+
223+
return '['.str_replace(']', ']]', $value).']';
224+
}
225+
220226
}

‎src/Illuminate/Database/Schema/Grammars/MySqlGrammar.php‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,6 @@
66

77
class MySqlGrammar extends Grammar {
88

9-
/**
10-
* The keyword identifier wrapper format.
11-
*
12-
* @var string
13-
*/
14-
protected $wrapper = '`%s`';
15-
169
/**
1710
* The possible column modifiers.
1811
*
@@ -574,4 +567,17 @@ protected function modifyAfter(Blueprint $blueprint, Fluent $column)
574567
}
575568
}
576569

570+
/**
571+
* Wrap a single string in keyword identifiers.
572+
*
573+
* @param string $value
574+
* @return string
575+
*/
576+
protected function wrapValue($value)
577+
{
578+
if ($value === '*') return $value;
579+
580+
return '`'.str_replace('`', '``', $value).'`';
581+
}
582+
577583
}

‎src/Illuminate/Database/Schema/Grammars/PostgresGrammar.php‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,6 @@
55

66
class PostgresGrammar extends Grammar {
77

8-
/**
9-
* The keyword identifier wrapper format.
10-
*
11-
* @var string
12-
*/
13-
protected $wrapper = '"%s"';
14-
158
/**
169
* The possible column modifiers.
1710
*

‎src/Illuminate/Database/Schema/Grammars/SQLiteGrammar.php‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,6 @@
66

77
class SQLiteGrammar extends Grammar {
88

9-
/**
10-
* The keyword identifier wrapper format.
11-
*
12-
* @var string
13-
*/
14-
protected $wrapper = '"%s"';
15-
169
/**
1710
* The possible column modifiers.
1811
*

‎src/Illuminate/Database/Schema/Grammars/SqlServerGrammar.php‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,6 @@
55

66
class SqlServerGrammar extends Grammar {
77

8-
/**
9-
* The keyword identifier wrapper format.
10-
*
11-
* @var string
12-
*/
13-
protected $wrapper = '"%s"';
14-
158
/**
169
* The possible column modifiers.
1710
*

‎src/Illuminate/Foundation/changes.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,8 @@
104104
{"message": "Added 'Auth::id' method to just get the authenticate user ID from the session / recaller cookie.", "backport": null},
105105
{"message": "New 'Input::exists' function for checking for the mere presence of input items.", "backport": null},
106106
{"message": "New system for invalidating remember me cookies on logout.", "backport": null},
107-
{"message": "Iron queue now accepts ssl_verifypeer configuration option.", "backport": null}
107+
{"message": "Iron queue now accepts ssl_verifypeer configuration option.", "backport": null},
108+
{"message": "Make column quoting more robust for greater security when passing an array of user input into update methods.", "backport": null}
108109
],
109110
"4.0.*": [
110111
{"message": "Added implode method to query builder and Collection class.", "backport": null},

‎tests/Database/DatabaseQueryBuilderTest.php‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,14 @@ public function testBasicSelect()
2020
}
2121

2222

23+
public function testBasicTableWrappingProtectsQuotationMarks()
24+
{
25+
$builder = $this->getBuilder();
26+
$builder->select('*')->from('some"table');
27+
$this->assertEquals('select * from "some""table"', $builder->toSql());
28+
}
29+
30+
2331
public function testAddingSelects()
2432
{
2533
$builder = $this->getBuilder();
@@ -127,6 +135,14 @@ public function testBasicWheres()
127135
}
128136

129137

138+
public function testMySqlWrappingProtectsQuotationMarks()
139+
{
140+
$builder = $this->getMySqlBuilder();
141+
$builder->select('*')->From('some`table');
142+
$this->assertEquals('select * from `some``table`', $builder->toSql());
143+
}
144+
145+
130146
public function testWhereDayMySql()
131147
{
132148
$builder = $this->getMySqlBuilder();

0 commit comments

Comments
 (0)