Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

optimize: optimize escape character for case of columnNames #5678

Merged
merged 3 commits into from
Jun 28, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changes/en-us/develop.md
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ Add changes here for all PR submitted to the develop branch.
- [[#5646](https://github.com/seata/seata/pull/5646)] refactor ColumnUtils and EscapeHandler
- [[#5648](https://github.com/seata/seata/pull/5648)] optimize server logs print
- [[#5647](https://github.com/seata/seata/pull/5647)] support case-sensitive attributes for table and column metadata
- [[#5678](https://github.com/seata/seata/pull/5678)] optimize escape character for case of columnNames

### security:
- [[#5172](https://github.com/seata/seata/pull/5172)] fix some security vulnerabilities
Expand Down
1 change: 1 addition & 0 deletions changes/zh-cn/develop.md
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@
- [[#5646](https://github.com/seata/seata/pull/5646)] 重构 ColumnUtils 和 EscapeHandler
- [[#5648](https://github.com/seata/seata/pull/5648)] 优化Server日志输出
- [[#5647](https://github.com/seata/seata/pull/5647)] 支持表和列元数据大小写敏感设置
- [[#5678](https://github.com/seata/seata/pull/5678)] 优化大小写转义符

### security:
- [[#5172](https://github.com/seata/seata/pull/5172)] 修复一些安全漏洞的版本
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
import io.seata.common.loader.LoadLevel;
import io.seata.common.util.StringUtils;
import io.seata.sqlparser.EscapeHandler;
import io.seata.sqlparser.struct.TableMeta;
import io.seata.sqlparser.util.JdbcConstants;

/**
Expand Down Expand Up @@ -1114,15 +1115,15 @@ public boolean checkIfKeyWords(String fieldOrTableName) {
}

@Override
public boolean checkIfNeedEscape(String fieldOrTableName) {
if (StringUtils.isBlank(fieldOrTableName)) {
public boolean checkIfNeedEscape(String columnName, TableMeta tableMeta) {
if (StringUtils.isBlank(columnName)) {
return false;
}
fieldOrTableName = fieldOrTableName.trim();
if (containsEscape(fieldOrTableName)) {
columnName = columnName.trim();
if (containsEscape(columnName)) {
return false;
}
return checkIfKeyWords(fieldOrTableName);
return checkIfKeyWords(columnName);
}

@Override
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
import io.seata.common.loader.LoadLevel;
import io.seata.common.util.StringUtils;
import io.seata.sqlparser.EscapeHandler;
import io.seata.sqlparser.struct.ColumnMeta;
import io.seata.sqlparser.struct.TableMeta;
import io.seata.sqlparser.util.JdbcConstants;

/**
Expand Down Expand Up @@ -502,15 +504,15 @@ public boolean checkIfKeyWords(String fieldOrTableName) {


@Override
public boolean checkIfNeedEscape(String fieldOrTableName) {
if (StringUtils.isBlank(fieldOrTableName)) {
public boolean checkIfNeedEscape(String columnName, TableMeta tableMeta) {
if (StringUtils.isBlank(columnName)) {
return false;
}
fieldOrTableName = fieldOrTableName.trim();
if (containsEscape(fieldOrTableName)) {
columnName = columnName.trim();
if (containsEscape(columnName)) {
return false;
}
boolean isKeyWord = checkIfKeyWords(fieldOrTableName);
boolean isKeyWord = checkIfKeyWords(columnName);
if (isKeyWord) {
return true;
}
Expand All @@ -526,7 +528,12 @@ public boolean checkIfNeedEscape(String fieldOrTableName) {
//"table" × × √ ×
//
//"TABLE" √ √ × √
if (isUppercase(fieldOrTableName)) {
if (null != tableMeta) {
ColumnMeta columnMeta = tableMeta.getColumnMeta(columnName);
if (null != columnMeta) {
return columnMeta.isCaseSensitive();
}
} else if (isUppercase(columnName)) {
return false;
}
return true;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
import io.seata.common.loader.LoadLevel;
import io.seata.common.util.StringUtils;
import io.seata.sqlparser.EscapeHandler;
import io.seata.sqlparser.struct.ColumnMeta;
import io.seata.sqlparser.struct.TableMeta;
import io.seata.sqlparser.util.JdbcConstants;

/**
Expand Down Expand Up @@ -370,19 +372,24 @@ public boolean checkIfKeyWords(String fieldOrTableName) {
}

@Override
public boolean checkIfNeedEscape(String fieldOrTableName) {
if (StringUtils.isBlank(fieldOrTableName)) {
public boolean checkIfNeedEscape(String columnName, TableMeta tableMeta) {
if (StringUtils.isBlank(columnName)) {
return false;
}
fieldOrTableName = fieldOrTableName.trim();
if (containsEscape(fieldOrTableName)) {
columnName = columnName.trim();
if (containsEscape(columnName)) {
return false;
}
boolean check = checkIfKeyWords(fieldOrTableName);
if (!check && !containsUppercase(fieldOrTableName)) {
// postgresql
// we are recommend table name and column name must lowercase.
// if exists uppercase character or full uppercase, the table name or column name must bundle escape symbol.
boolean isKeyWord = checkIfKeyWords(columnName);
if (isKeyWord) {
return true;
}
if (null != tableMeta) {
ColumnMeta columnMeta = tableMeta.getColumnMeta(columnName);
if (null != columnMeta) {
return columnMeta.isCaseSensitive();
}
} else if (!containsUppercase(columnName)) {
return false;
}
return true;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@
package io.seata.sqlparser;

import io.seata.common.util.StringUtils;
import io.seata.sqlparser.struct.ColumnMeta;
import io.seata.sqlparser.struct.TableMeta;

/**
Expand All @@ -38,10 +37,11 @@ public interface EscapeHandler {

/**
* check whether given field or table name use keywords. the method has database special logic.
* @param fieldOrTableName the field or table name
* @param columnName the column or table name
* @param tableMeta the tableMeta
* @return true: need to escape. false: no need to escape.
*/
boolean checkIfNeedEscape(String fieldOrTableName);
boolean checkIfNeedEscape(String columnName, TableMeta tableMeta);

default char getEscapeSymbol() {
return '"';
Expand Down Expand Up @@ -77,16 +77,10 @@ default String addColNameEscape(String colName) {
* @return colName
*/
default String addColNameEscape(String colName, TableMeta tableMeta) {
boolean needEscape = checkIfNeedEscape(colName);
boolean needEscape = checkIfNeedEscape(colName, tableMeta);
if (!needEscape) {
return colName;
}
if (tableMeta != null) {
ColumnMeta columnMeta = tableMeta.getColumnMeta(colName);
if (columnMeta != null) {
colName = columnMeta.getColumnName();
}
}
char escapeChar = getEscapeSymbol();
if (colName.contains(DOT)) {
// like "scheme".id `scheme`.id
Expand Down