jyapayne/Nim
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix #15219 SQL escape in db_mysql is not enough (#15234)

Browse source
This commit is contained in:
Bung 2020-09-04 17:04:27 +08:00 • committed by GitHub
commit c16ee37a71
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

20
lib/impure/db_mysql.nim
View file

@ -118,10 +118,24 @@ when false:
proc dbQuote*(s: string): string = proc dbQuote*(s: string): string =
## DB quotes the string. ## DB quotes the string.
result = "'" result = newStringOfCap(s.len + 2)
result.add "'"
for c in items(s): for c in items(s):
if c == '\'': add(result, "''") # see https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html#mysql-escaping
else: add(result, c) case c
of '\0': result.add "\\0"
of '\b': result.add "\\b"
of '\t': result.add "\\t"
of '\l': result.add "\\n"
of '\r': result.add "\\r"
of '\x1a': result.add "\\Z"
of '"': result.add "\\\""
of '%': result.add "\\%"
of '\'': result.add "\\'"
of '\\': result.add "\\\\"
of '_': result.add "\\_"
of Letters+Digits: result.add c
else: result.add "\\" & $ord(c)
add(result, '\'') add(result, '\'')
proc dbFormat(formatstr: SqlQuery, args: varargs[string]): string = proc dbFormat(formatstr: SqlQuery, args: varargs[string]): string =