vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge pull request #17180 from gavindsouza/sub-query-err

Browse source 
fix(db_query): Remove wanton whitespace split check
This commit is contained in:
gavin 2022-06-14 17:43:11 +05:30 • committed by GitHub
commit fb6a092292
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 23 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
frappe/__init__.py
View file

@ -15,6 +15,7 @@ import importlib
import inspect
import json
import os
import re
import warnings
from typing import TYPE_CHECKING, Any, Dict, List, Optional, Union
@ -45,6 +46,10 @@ STANDARD_USERS = ("Guest", "Administrator")
_dev_server = int(sbool(os.environ.get("DEV_SERVER", False)))
_qb_patched = False
re._MAXCACHE = (
50 # reduced from default 512 given we are already maintaining this on parent worker
)
if _dev_server:
warnings.simplefilter("always", DeprecationWarning)

33
frappe/model/db_query.py
View file

@ -40,6 +40,16 @@ CAST_VARCHAR_PATTERN = re.compile(
r"([`\"]?tab[\w`\" -]+\.[`\"]?name[`\"]?)(?!\w)", flags=re.IGNORECASE
)
ORDER_BY_PATTERN = re.compile(r"\ order\ by\ |\ asc|\ ASC|\ desc|\ DESC", flags=re.IGNORECASE)
SUB_QUERY_PATTERN = re.compile("^.*[,();@].*")
IS_QUERY_PATTERN = re.compile(r"^(select|delete|update|drop|create)\s")
IS_QUERY_PREDICATE_PATTERN = re.compile(
r"\s*[0-9a-zA-z]*\s*( from | group by | order by | where | join )"
)
FIELD_QUOTE_PATTERN = re.compile(r"[0-9a-zA-Z]+\s*'")
FIELD_COMMA_PATTERN = re.compile(r"[0-9a-zA-Z]+\s*,")
STRICT_FIELD_PATTERN = re.compile(r".*/\*.*")
STRICT_UNION_PATTERN = re.compile(r".*\s(union).*\s")
ORDER_GROUP_PATTERN = re.compile(r".*[^a-z0-9-_ ,`'\"\.\(\)].*")
class DatabaseQuery(object):
@ -343,8 +353,6 @@ class DatabaseQuery(object):
As field contains `,` and mysql function `version()`, with the help of regex
the system will filter out this field.
"""
sub_query_regex = re.compile("^.*[,();@].*")
blacklisted_keywords = ["select", "create", "insert", "delete", "drop", "update", "case", "show"]
blacklisted_functions = [
"concat",
@ -368,19 +376,14 @@ class DatabaseQuery(object):
frappe.throw(_("Use of sub-query or function is restricted"), frappe.DataError)
def _is_query(field):
if re.compile(r"^(select|delete|update|drop|create)\s").match(field):
if IS_QUERY_PATTERN.match(field):
_raise_exception()
elif re.compile(r"\s*[0-9a-zA-z]*\s*( from | group by | order by | where | join )").match(
field
):
elif IS_QUERY_PREDICATE_PATTERN.match(field):
_raise_exception()
for field in self.fields:
if sub_query_regex.match(field):
if any(keyword in field.lower().split() for keyword in blacklisted_keywords):
_raise_exception()
if SUB_QUERY_PATTERN.match(field):
if any(f"({keyword}" in field.lower() for keyword in blacklisted_keywords):
_raise_exception()
@ -391,19 +394,19 @@ class DatabaseQuery(object):
# prevent access to global variables
_raise_exception()
if re.compile(r"[0-9a-zA-Z]+\s*'").match(field):
if FIELD_QUOTE_PATTERN.match(field):
_raise_exception()
if re.compile(r"[0-9a-zA-Z]+\s*,").match(field):
if FIELD_COMMA_PATTERN.match(field):
_raise_exception()
_is_query(field)
if self.strict:
if re.compile(r".*/\*.*").match(field):
if STRICT_FIELD_PATTERN.match(field):
frappe.throw(_("Illegal SQL Query"))
if re.compile(r".*\s(union).*\s").match(field.lower()):
if STRICT_UNION_PATTERN.match(field.lower()):
frappe.throw(_("Illegal SQL Query"))
def extract_tables(self):
@ -910,7 +913,7 @@ class DatabaseQuery(object):
if "select" in _lower and "from" in _lower:
frappe.throw(_("Cannot use sub-query in order by"))
if re.compile(r".*[^a-z0-9-_ ,`'\"\.\(\)].*").match(_lower):
if ORDER_GROUP_PATTERN.match(_lower):
frappe.throw(_("Illegal SQL Query"))
for field in parameters.split(","):