feat(kotlin): fix offest & limit issues

archguard · Mar 31, 2022 · 86d2b5f · 86d2b5f
1 parent fb6bbfe
commit 86d2b5f
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 6 deletions.
diff --git a/scan_sourcecode/src/main/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyser.kt b/scan_sourcecode/src/main/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyser.kt
@@ -17,6 +17,7 @@ data class SqlRecord(
 class MysqlAnalyser {
     private val logger = LoggerFactory.getLogger(javaClass)
 
+    // todo: split by framework
     fun analysisByNode(node: CodeDataStruct, workspace: String): MutableList<SqlRecord> {
         val logs: MutableList<SqlRecord> = mutableListOf()
         // by annotation: identify
@@ -38,6 +39,7 @@ class MysqlAnalyser {
                 }
             }
 
+            // try to catch in function call
             function.FunctionCalls.forEach {
                 val callMethodName = it.FunctionName.split(".").last()
                 if (callMethodName == "createQuery" && it.Parameters.isNotEmpty()) {
@@ -72,12 +74,23 @@ class MysqlAnalyser {
     fun sqlify(value: String): String {
         var text = handleRawString(value)
         text = removeBeginEndQuotes(text)
+
+        // handle for variable
         text = removeVariableInLine(text)
         text = removeKotlinVariable(text)
-        text = removeNextLine(text)
         text = removeJdbiValueBind(text)
-        text = removePlus(text)
+        text = removeEndWithMultipleSingleQuote(text)
+
+        text = removeNextLine(text)
+        // " " + module
+        text = removePlusWithVariable(text)
+        // " " + " "
+        text = removePlusSymbol(text)
         text = processIn(text)
+
+        // sql fixed
+        text = fillLimitEmpty(text)
+        text = fillOffsetEmpty(text)
         return text
     }
 
@@ -142,6 +155,10 @@ class MysqlAnalyser {
     }
 
     private fun removeNextLine(text: String) = text.replace("\n", "")
-    private fun removePlus(text: String) = text.replace("\"+\"", "")
+    private fun removePlusSymbol(text: String) = text.replace("\"+\"", "")
+    private fun removePlusWithVariable(text: String) = text.replace("\"\\+([a-zA-Z_]+)".toRegex(), "")
+    private fun removeEndWithMultipleSingleQuote(text: String) = text.replace("\'\'\\s+\'\'".toRegex(), "''")
     private fun removeBeginEndQuotes(value: String) = value.removeSuffix("\"").removePrefix("\"")
+    private fun fillLimitEmpty(value: String) = value.replace("offset ''", "offset 10")
+    private fun fillOffsetEmpty(value: String) = value.replace("limit ''", "limit 10")
 }
diff --git a/...sourcecode/src/test/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyserTest.kt b/...sourcecode/src/test/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyserTest.kt
@@ -46,15 +46,19 @@ internal class MysqlAnalyserTest {
     @Test
     fun should_kotlin_variable_in_sql_without_quote() {
         val sqlify = MysqlAnalyser().sqlify("select id, module_name from system and c.name = ${'$'}name")
+        assertEquals("select id, module_name from system and c.name = ''", sqlify)
+    }
 
+    @Test
+    fun should_handle_end_with_string_append() {
+        val sqlify = MysqlAnalyser().sqlify("select id, module_name from system and c.name = ${'$'}name\"+moduleFilter")
         assertEquals("select id, module_name from system and c.name = ''", sqlify)
     }
 
     @Test
     fun should_handle_kotlin_string_in_sql() {
-        val sqlify = MysqlAnalyser().sqlify("\"select id, name, module, loc, access from code_class where system_id=:systemId and name=:name and module <=> :module\"")
-
-        assertEquals("select id, name, module, loc, access from code_class where system_id='' and name='' and module <=> ''", sqlify)
+        val sqlify = MysqlAnalyser().sqlify("SELECT id, name, module, loc, access FROM code_class where system_id = '' and name = '' '' limit ''")
+        assertEquals("SELECT id, name, module, loc, access FROM code_class where system_id = '' and name = '' limit 10", sqlify)
     }
 
     @Test