Changeset 2319

Timestamp:

11/29/09 20:18:59 (2 years ago)

Author:

karpet

Message:

release 0.08

Location:

Sort-SQL/trunk

Files:

• Changes (modified) (1 diff)
• lib/Sort/SQL.pm (modified) (2 diffs)
• t/02-sql-injection.t (modified) (2 diffs)

Sort-SQL/trunk/Changes

@@ -25 +25 @@
           that match \W
 
+0.08  29 Nov 2009
+        - fix regex in SQL-injection filter from 0.07 to allow table
+          prefixes on column names.
+

Sort-SQL/trunk/lib/Sort/SQL.pm

@@ -5 +5 @@
 use vars qw( $VERSION );    # for version 5.005...
 
-$VERSION = '0.07';
+$VERSION = '0.08';
+
+my $debug = $ENV{PERL_DEBUG} || 0;
 
 sub parse {
@@ -16 +18 @@
     while ( my ( $prop, $dir ) = splice( @s, 0, 2 ) ) {
 
-        next if $prop =~ m/\W/;    # avoid sql injection
+        $debug and warn sprintf( "prop='%s'  dir='%s'\n", $prop, $dir || '' );
+
+        next if $prop =~ m/[^\.\w]/;    # avoid sql injection
 
         if ( !defined $dir ) {

Sort-SQL/trunk/t/02-sql-injection.t

@@ -1 +1 @@
 use strict;
 use warnings;
-use Test::More tests => 3;
+use Test::More tests => 5;
+
+#use Data::Dump qw( dump );
+
 use_ok('Sort::SQL');
 
 #use Data::Dump qw( dump );
 
-my $nefarious_sql = "name id; drop\rtable\rtest;\rselect\r1\r";
+my $nefarious_sql = "name, id; drop\rtable\rtest;\rselect\r1\r";
 
 ok( my $parsed = Sort::SQL->string2array($nefarious_sql),
@@ -14 +17 @@
 
 is_deeply( $parsed, [ { name => 'ASC' } ], "bad sql is stripped" );
+
+my $more_bad_sql = "t1.name DESC, t2.id asc;drop\rtable\rtest;select\r1";
+
+ok( my $parsed2 = Sort::SQL->string2array($more_bad_sql),
+    "parse order string 2" );
+
+#diag( dump($parsed2) );
+
+is_deeply(
+    $parsed2,
+    [ { 't1.name' => 'DESC' }, { 't2.id' => 'ASC' } ],
+    "more bad sql is stripped"
+);