[CONJ-618] Client preparestatement parsing error on escaped ' / " in …

…query (not parameters)
mariadb-corporation · Jun 14, 2018 · e9e8acc · e9e8acc
1 parent f5587ac
commit e9e8acc
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 6 deletions.
diff --git a/src/main/java/org/mariadb/jdbc/internal/util/dao/ClientPrepareResult.java b/src/main/java/org/mariadb/jdbc/internal/util/dao/ClientPrepareResult.java
@@ -107,9 +107,8 @@ public static ClientPrepareResult parameterParts(String queryString, boolean noB
             int queryLength = query.length;
             for (int i = 0; i < queryLength; i++) {
 
-                if (state == LexState.Escape) state = LexState.String;
-
                 char car = query[i];
+                if (state == LexState.Escape && !((car == '\'' && singleQuotes) || (car == '"' && !singleQuotes))) state = LexState.String;
                 switch (car) {
                     case '*':
                         if (state == LexState.Normal && lastChar == '/') state = LexState.SlashStarComment;
@@ -147,6 +146,8 @@ public static ClientPrepareResult parameterParts(String queryString, boolean noB
                             singleQuotes = false;
                         } else if (state == LexState.String && !singleQuotes) {
                             state = LexState.Normal;
+                        } else if (state == LexState.Escape && !singleQuotes) {
+                            state = LexState.String;
                         }
                         break;
 
@@ -156,6 +157,8 @@ public static ClientPrepareResult parameterParts(String queryString, boolean noB
                             singleQuotes = true;
                         } else if (state == LexState.String && singleQuotes) {
                             state = LexState.Normal;
+                        } else if (state == LexState.Escape && singleQuotes) {
+                            state = LexState.String;
                         }
                         break;
 
@@ -226,7 +229,7 @@ public static boolean canAggregateSemiColon(String queryString, boolean noBacksl
 
         for (char car : query) {
 
-            if (state == LexState.Escape) state = LexState.String;
+            if (state == LexState.Escape && !((car == '\'' && singleQuotes) || (car == '"' && !singleQuotes))) state = LexState.String;
 
             switch (car) {
                 case '*':
@@ -266,6 +269,8 @@ public static boolean canAggregateSemiColon(String queryString, boolean noBacksl
                         singleQuotes = false;
                     } else if (state == LexState.String && !singleQuotes) {
                         state = LexState.Normal;
+                    } else if (state == LexState.Escape && !singleQuotes) {
+                        state = LexState.String;
                     }
                     break;
 
@@ -275,6 +280,8 @@ public static boolean canAggregateSemiColon(String queryString, boolean noBacksl
                         singleQuotes = true;
                     } else if (state == LexState.String && singleQuotes) {
                         state = LexState.Normal;
+                    } else if (state == LexState.Escape && singleQuotes) {
+                        state = LexState.String;
                     }
                     break;
 
@@ -373,13 +380,13 @@ public static ClientPrepareResult rewritableParts(String queryString, boolean no
             int queryLength = query.length;
             for (int i = 0; i < queryLength; i++) {
 
-                if (state == LexState.Escape) {
-                    sb.append(query[i]);
+                char car = query[i];
+                if (state == LexState.Escape && !((car == '\'' && singleQuotes) || (car == '"' && !singleQuotes))) {
+                    sb.append(car);
                     state = LexState.String;
                     continue;
                 }
 
-                char car = query[i];
                 switch (car) {
                     case '*':
                         if (state == LexState.Normal && lastChar == '/') state = LexState.SlashStarComment;
@@ -413,6 +420,8 @@ public static ClientPrepareResult rewritableParts(String queryString, boolean no
                             singleQuotes = false;
                         } else if (state == LexState.String && !singleQuotes) {
                             state = LexState.Normal;
+                        } else if (state == LexState.Escape && !singleQuotes) {
+                            state = LexState.String;
                         }
                         break;
                     case ';':
@@ -427,6 +436,8 @@ public static ClientPrepareResult rewritableParts(String queryString, boolean no
                             singleQuotes = true;
                         } else if (state == LexState.String && singleQuotes) {
                             state = LexState.Normal;
+                        } else if (state == LexState.Escape && singleQuotes) {
+                            state = LexState.String;
                         }
                         break;
 

diff --git a/src/test/java/org/mariadb/jdbc/ClientPreparedStatementParsingTest.java b/src/test/java/org/mariadb/jdbc/ClientPreparedStatementParsingTest.java
@@ -81,6 +81,21 @@ private boolean checkParsing(String sql, int paramNumber, boolean rewritable, bo
         return true;
     }
 
+    @Test
+    public void stringEscapeParsing() throws Exception {
+        assertTrue(checkParsing("select '\\'' as a, ? as b, \"\\\"\" as c, ? as d",
+                2, true, true,
+                new String[]{
+                        "select '\\'' as a, ",
+                        " as b, \"\\\"\" as c, ",
+                        " as d"},
+                new String[]{
+                        "select '\\'' as a, ",
+                        " as b, \"\\\"\" as c, ",
+                        " as d"}));
+    }
+
+
     @Test
     public void testRewritableWithConstantParameter() throws Exception {
         assertTrue(checkParsing("INSERT INTO TABLE(col1,col2,col3,col4, col5) VALUES (9, ?, 5, ?, 8) ON DUPLICATE KEY UPDATE col2=col2+10",