Unverified Commit c9c0fc1e authored by alexpott's avatar alexpott

Issue #3133798 by Beakerboy, daffie: Semicolon removed from query even when it is allowed

parent 483c579e
......@@ -725,8 +725,12 @@ public function query($query, array $args = [], $options = []) {
// semicolon) is not allowed unless the option is set. Allowing
// semicolons should only be needed for special cases like defining a
// function or stored procedure in SQL. Trim any trailing delimiter to
// minimize false positives.
$query = rtrim($query, "; \t\n\r\0\x0B");
// minimize false positives unless delimiter is allowed.
$trim_chars = " \t\n\r\0\x0B";
if (empty($options['allow_delimiter_in_query'])) {
$trim_chars .= ';';
}
$query = rtrim($query, $trim_chars);
if (strpos($query, ';') !== FALSE && empty($options['allow_delimiter_in_query'])) {
throw new \InvalidArgumentException('; is not supported in SQL strings. Use only one statement at a time.');
}
......
......@@ -576,4 +576,58 @@ public function testNamespaceDefault() {
$this->assertSame('Drupal\Tests\Core\Database\Stub', $connection->getConnectionOptions()['namespace']);
}
/**
* Test rtrim() of query strings.
*
* @dataProvider provideQueriesToTrim
*/
public function testQueryTrim($expected, $query, $options) {
$mock_pdo = $this->getMockBuilder(StubPdo::class)
->setMethods(['execute', 'prepare', 'setAttribute'])
->getMock();
// Ensure that PDO::prepare() is called only once, and with the
// correctly trimmed query string.
$mock_pdo->expects($this->once())
->method('prepare')
->with($expected)
->willReturnSelf();
$connection = new StubConnection($mock_pdo, []);
$connection->query($query, [], $options);
}
/**
* Dataprovider for testQueryTrim().
*
* @return array
* Array of arrays with the following elements:
* - Expected trimmed query.
* - Padded query.
* - Query options.
*/
public function provideQueriesToTrim() {
return [
'remove_semicolon' => [
'SELECT * FROM test',
'SELECT * FROM test;',
[],
],
'keep_trailing_semicolon' => [
'SELECT * FROM test;',
'SELECT * FROM test;',
['allow_delimiter_in_query' => TRUE],
],
'remove_semicolon_with_whitespace' => [
'SELECT * FROM test',
'SELECT * FROM test; ',
[],
],
'keep_trailing_semicolon_with_whitespace' => [
'SELECT * FROM test;',
'SELECT * FROM test; ',
['allow_delimiter_in_query' => TRUE],
],
];
}
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment