agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-11-14 14:13:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix SQL injection.

Browse Source
This commit is contained in:
Winston Li
2015-02-23 11:00:34 +00:00
parent 4561409450
commit 77c4576b59
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/git-bridge/src/main/java/uk/ac/ic/wlgitbridge/writelatex/model/db/sql/update/delete/DeleteFilesForProjectSQLUpdate.java
+4 -3
View File
@@ -25,9 +25,7 @@ public class DeleteFilesForProjectSQLUpdate implements SQLUpdate {
public String getSQL() { public String getSQL() {
StringBuilder sb = new StringBuilder(DELETE_URL_INDEXES_FOR_PROJECT_NAME); StringBuilder sb = new StringBuilder(DELETE_URL_INDEXES_FOR_PROJECT_NAME);
for (int i = 0; i < paths.length; i++) { for (int i = 0; i < paths.length; i++) {
sb.append('\''); sb.append("?");
sb.append(paths[i]);
sb.append('\'');
if (i < paths.length - 1) { if (i < paths.length - 1) {
sb.append(", "); sb.append(", ");
} }
@@ -39,6 +37,9 @@ public class DeleteFilesForProjectSQLUpdate implements SQLUpdate {
@Override @Override
public void addParametersToStatement(PreparedStatement statement) throws SQLException { public void addParametersToStatement(PreparedStatement statement) throws SQLException {
statement.setString(1, projectName); statement.setString(1, projectName);
for (int i = 0; i < paths.length; i++) {
statement.setString(i + 2, paths[i]);
}
} }
} }
services/git-bridge/src/test/java/uk/ac/ic/wlgitbridge/writelatex/model/db/sql/update/delete/DeleteFilesForProjectSQLUpdateTest.java
+1 -1
View File
@@ -8,7 +8,7 @@ public class DeleteFilesForProjectSQLUpdateTest {
@Test @Test
public void testGetSQL() { public void testGetSQL() {
DeleteFilesForProjectSQLUpdate update = new DeleteFilesForProjectSQLUpdate("projname", "path1", "path2"); DeleteFilesForProjectSQLUpdate update = new DeleteFilesForProjectSQLUpdate("projname", "path1", "path2");
assertEquals("DELETE FROM `url_index_store` WHERE `project_name` = ? AND path IN ('path1', 'path2');\n", update.getSQL()); assertEquals("DELETE FROM `url_index_store` WHERE `project_name` = ? AND path IN (?, ?);\n", update.getSQL());
} }
} }