[mapserver-commits] r11891 - branches/branch-5-6/mapserver
svn at osgeo.org
svn at osgeo.org
Tue Jul 12 09:09:18 EDT 2011
Author: assefa
Date: 2011-07-12 06:09:18 -0700 (Tue, 12 Jul 2011)
New Revision: 11891
Modified:
branches/branch-5-6/mapserver/HISTORY.TXT
branches/branch-5-6/mapserver/maplayer.c
branches/branch-5-6/mapserver/mapogcfilter.c
branches/branch-5-6/mapserver/mapogcfilter.h
branches/branch-5-6/mapserver/mapogcsos.c
branches/branch-5-6/mapserver/mapogr.cpp
branches/branch-5-6/mapserver/mappostgis.c
branches/branch-5-6/mapserver/mapserver.h
Log:
Security fixes (#3903)
Modified: branches/branch-5-6/mapserver/HISTORY.TXT
===================================================================
--- branches/branch-5-6/mapserver/HISTORY.TXT 2011-07-12 13:06:14 UTC (rev 11890)
+++ branches/branch-5-6/mapserver/HISTORY.TXT 2011-07-12 13:09:18 UTC (rev 11891)
@@ -14,6 +14,14 @@
Version 5.6.7 (SVN branch-5-6):
---------------------------
+IMPORTANT SECURITY FIXE:
+
+- Fixes to prevent SQL injections through OGC filter encoding (in WMS, WFS
+ and SOS), as well as a potential SQL injection in WMS time support.
+ Your system may be vulnerable if it has MapServer with OGC protocols
+ enabled, with layers connecting to an SQL RDBMS backend, either
+ natively or via OGR (#3903)
+
- Fixed PHP/MapScript ms_iogetstdoutbufferbytes() always returning 0 bytes written (#3041)
- OGC Filter: fix segfault when a ows_varname_type or wfs_varname_type is
Modified: branches/branch-5-6/mapserver/maplayer.c
===================================================================
--- branches/branch-5-6/mapserver/maplayer.c 2011-07-12 13:06:14 UTC (rev 11890)
+++ branches/branch-5-6/mapserver/maplayer.c 2011-07-12 13:09:18 UTC (rev 11891)
@@ -1051,6 +1051,85 @@
return MS_FAILURE;
}
+/************************************************************************/
+/* LayerDefaultEscapeSQLParam */
+/* */
+/* Default function used to escape strings and avoid sql */
+/* injection. Specific drivers should redefine if an escaping */
+/* function is available in the driver. */
+/************************************************************************/
+char *LayerDefaultEscapeSQLParam(layerObj *layer, const char* pszString)
+{
+ char *pszEscapedStr=NULL;
+ if (pszString)
+ {
+ int nSrcLen;
+ char c;
+ int i=0, j=0;
+ nSrcLen = (int)strlen(pszString);
+ pszEscapedStr = (char*) malloc( 2 * nSrcLen + 1);
+ for(i = 0, j = 0; i < nSrcLen; i++)
+ {
+ c = pszString[i];
+ if (c == '\'')
+ {
+ pszEscapedStr[j++] = '\'';
+ pszEscapedStr[j++] = '\'';
+ }
+ else if (c == '\\')
+ {
+ pszEscapedStr[j++] = '\\';
+ pszEscapedStr[j++] = '\\';
+ }
+ else
+ pszEscapedStr[j++] = c;
+ }
+ pszEscapedStr[j] = 0;
+ }
+ return pszEscapedStr;
+}
+
+/************************************************************************/
+/* LayerDefaultEscapePropertyName */
+/* */
+/* Return the property name in a properly escaped and quoted form. */
+/************************************************************************/
+char *LayerDefaultEscapePropertyName(layerObj *layer, const char* pszString)
+{
+ char* pszEscapedStr=NULL;
+ int i, j = 0;
+
+ if (layer && pszString && strlen(pszString) > 0)
+ {
+ int nLength = strlen(pszString);
+
+ pszEscapedStr = (char*) malloc( 1 + 2 * nLength + 1 + 1);
+ pszEscapedStr[j++] = '"';
+
+ for (i=0; i<nLength; i++)
+ {
+ char c = pszString[i];
+ if (c == '"')
+ {
+ pszEscapedStr[j++] = '"';
+ pszEscapedStr[j++] ='"';
+ }
+ else if (c == '\\')
+ {
+ pszEscapedStr[j++] = '\\';
+ pszEscapedStr[j++] = '\\';
+ }
+ else
+ pszEscapedStr[j++] = c;
+ }
+ pszEscapedStr[j++] = '"';
+ pszEscapedStr[j++] = 0;
+
+ }
+ return pszEscapedStr;
+}
+
+
/*
* msConnectLayer
*
@@ -1108,6 +1187,10 @@
vtable->LayerGetNumFeatures = LayerDefaultGetNumFeatures;
+ vtable->LayerEscapeSQLParam = LayerDefaultEscapeSQLParam;
+
+ vtable->LayerEscapePropertyName = LayerDefaultEscapePropertyName;
+
return MS_SUCCESS;
}
@@ -1280,6 +1363,32 @@
return i;
}
+
+
+/*
+Returns an escaped string
+*/
+char *msLayerEscapeSQLParam(layerObj *layer, const char*pszString)
+{
+ if ( ! layer->vtable) {
+ int rv = msInitializeVirtualTable(layer);
+ if (rv != MS_SUCCESS)
+ return "";
+ }
+ return layer->vtable->LayerEscapeSQLParam(layer, pszString);
+}
+
+char *msLayerEscapePropertyName(layerObj *layer, const char*pszString)
+{
+ if ( ! layer->vtable) {
+ int rv = msInitializeVirtualTable(layer);
+ if (rv != MS_SUCCESS)
+ return "";
+ }
+ return layer->vtable->LayerEscapePropertyName(layer, pszString);
+}
+
+
int
msINLINELayerInitializeVirtualTable(layerObj *layer)
{
@@ -1312,5 +1421,7 @@
/* layer->vtable->LayerCreateItems, use default */
layer->vtable->LayerGetNumFeatures = msINLINELayerGetNumFeatures;
+ /*layer->vtable->LayerEscapeSQLParam, use default*/
+ /*layer->vtable->LayerEscapePropertyName, use default*/
return MS_SUCCESS;
}
Modified: branches/branch-5-6/mapserver/mapogcfilter.c
===================================================================
--- branches/branch-5-6/mapserver/mapogcfilter.c 2011-07-12 13:06:14 UTC (rev 11890)
+++ branches/branch-5-6/mapserver/mapogcfilter.c 2011-07-12 13:09:18 UTC (rev 11891)
@@ -175,7 +175,7 @@
if (tokens && nTokens == 2)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%s",tokens[1]);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%s",tokens[1]);
msInitProjection(psProj);
if (msLoadProjectionString(psProj, szTmp) == 0)
nStatus = MS_TRUE;
@@ -200,7 +200,7 @@
if (nEpsgTmp > 0)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%d",nEpsgTmp);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%d",nEpsgTmp);
msInitProjection(psProj);
if (msLoadProjectionString(psProj, szTmp) == 0)
nStatus = MS_TRUE;
@@ -996,7 +996,7 @@
if (tokens && nTokens == 2)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%s",tokens[1]);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%s",tokens[1]);
msInitProjection(&sProjTmp);
if (msLoadProjectionString(&sProjTmp, szTmp) == 0)
msProjectRect(&sProjTmp, &map->projection, &sQueryRect);
@@ -1021,7 +1021,7 @@
if (nEpsgTmp > 0)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%d",nEpsgTmp);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%d",nEpsgTmp);
msInitProjection(&sProjTmp);
if (msLoadProjectionString(&sProjTmp, szTmp) == 0)
msProjectRect(&sProjTmp, &map->projection, &sQueryRect);
@@ -2798,9 +2798,9 @@
bString = 1;
}
if (bString)
- sprintf(szTmp, "('[%s]' = '%s')" , pszAttribute, tokens[i]);
+ snprintf(szTmp, sizeof(szTmp), "('[%s]' = '%s')" , pszAttribute, tokens[i]);
else
- sprintf(szTmp, "([%s] = %s)" , pszAttribute, tokens[i]);
+ snprintf(szTmp, sizeof(szTmp), "([%s] = %s)" , pszAttribute, tokens[i]);
if (pszExpression != NULL)
pszExpression = msStringConcatenate(pszExpression, " OR ");
@@ -2865,8 +2865,7 @@
"PropertyIsLike") == 0)
{
pszExpression =
- FLTGetIsLikeComparisonSQLExpression(psFilterNode,
- connectiontype);
+ FLTGetIsLikeComparisonSQLExpression(psFilterNode, lp);
}
}
}
@@ -2903,6 +2902,7 @@
bString = 0;
if (tokens && nTokens > 0)
{
+ char *pszEscapedStr = NULL;
for (i=0; i<nTokens; i++)
{
if (i == 0)
@@ -2910,7 +2910,7 @@
char *pszTmpType = NULL;
pszTmpType = (char *)malloc(sizeof(char)*strlen(pszAttribute)+7);
pszTmp = tokens[0];
- sprintf(pszTmpType, "%s_type", pszAttribute);
+ snprintf(pszTmpType, sizeof(szTmp), "%s_type", pszAttribute);
if (msOWSLookupMetadata(&(lp->metadata), "G", pszTmpType) != NULL &&
(strcasecmp(msOWSLookupMetadata(&(lp->metadata), "G", pszTmpType), "Character") == 0))
bString = 1;
@@ -2920,11 +2920,15 @@
msFree(pszTmpType);
}
+ pszEscapedStr = msLayerEscapeSQLParam(lp, tokens[i]);
if (bString)
- sprintf(szTmp, "(%s = '%s')" , pszAttribute, tokens[i]);
+ snprintf(szTmp, sizeof(szTmp), "(%s = '%s')" , pszAttribute, pszEscapedStr);
else
- sprintf(szTmp, "(%s = %s)" , pszAttribute, tokens[i]);
+ snprintf(szTmp, sizeof(szTmp), "(%s = %s)" , pszAttribute, pszEscapedStr);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+
if (pszExpression != NULL)
pszExpression = msStringConcatenate(pszExpression, " OR ");
else
@@ -3208,6 +3212,7 @@
/************************************************************************/
char *FLTGetBinaryComparisonExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
int bString=0;
char szTmp[256];
@@ -3238,16 +3243,16 @@
if (bString)
- strcat(szBuffer, " (\"[");
+ strlcat(szBuffer, " (\"[", bufferSize);
else
- strcat(szBuffer, " ([");
+ strlcat(szBuffer, " ([", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "]\" ");
+ strlcat(szBuffer, "]\" ", bufferSize);
else
- strcat(szBuffer, "] ");
+ strlcat(szBuffer, "] ", bufferSize);
/* logical operator */
@@ -3258,40 +3263,40 @@
if (psFilterNode->psRightNode->pOther &&
(*(int *)psFilterNode->psRightNode->pOther) == 1)
{
- strcat(szBuffer, "IEQ");
+ strlcat(szBuffer, "IEQ", bufferSize);
}
else
- strcat(szBuffer, "=");
+ strlcat(szBuffer, "=",bufferSize);
}
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsNotEqualTo") == 0)
- strcat(szBuffer, "!=");
+ strlcat(szBuffer, "!=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThan") == 0)
- strcat(szBuffer, "<");
+ strlcat(szBuffer, "<", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThan") == 0)
- strcat(szBuffer, ">");
+ strlcat(szBuffer, ">", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThanOrEqualTo") == 0)
- strcat(szBuffer, "<=");
+ strlcat(szBuffer, "<=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThanOrEqualTo") == 0)
- strcat(szBuffer, ">=");
+ strlcat(szBuffer, ">=", bufferSize);
- strcat(szBuffer, " ");
+ strlcat(szBuffer, " ", bufferSize);
/* value */
if (bString)
- strcat(szBuffer, "\"");
+ strlcat(szBuffer, "\"", bufferSize);
if (psFilterNode->psRightNode->pszValue)
- strcat(szBuffer, psFilterNode->psRightNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psRightNode->pszValue,bufferSize);
if (bString)
- strcat(szBuffer, "\"");
+ strlcat(szBuffer, "\"",bufferSize);
- strcat(szBuffer, ") ");
+ strlcat(szBuffer, ") ",bufferSize);
return strdup(szBuffer);
}
@@ -3306,9 +3311,11 @@
char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode,
layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
int bString=0;
char szTmp[256];
+ char* pszEscapedStr = NULL;
szBuffer[0] = '\0';
if (!psFilterNode || !
@@ -3338,8 +3345,10 @@
/*opening bracket*/
- strcat(szBuffer, " (");
+ strlcat(szBuffer, " (", bufferSize);
+ pszEscapedStr = msLayerEscapePropertyName(lp, psFilterNode->psLeftNode->pszValue);
+
/* attribute */
/*case insensitive set ? */
if (bString &&
@@ -3348,35 +3357,37 @@
psFilterNode->psRightNode->pOther &&
(*(int *)psFilterNode->psRightNode->pOther) == 1)
{
- sprintf(szTmp, "lower(%s) ", psFilterNode->psLeftNode->pszValue);
- strcat(szBuffer, szTmp);
+ snprintf(szTmp, sizeof(szTmp), "lower(%s) ", pszEscapedStr);
+ strlcat(szBuffer, szTmp, bufferSize);
}
else
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
/* logical operator */
- if (strcasecmp(psFilterNode->pszValue,
+ if (strcasecmp(psFilterNode->pszValue,
"PropertyIsEqualTo") == 0)
- strcat(szBuffer, "=");
+ strlcat(szBuffer, "=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsNotEqualTo") == 0)
- strcat(szBuffer, "<>");
+ strlcat(szBuffer, "<>", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThan") == 0)
- strcat(szBuffer, "<");
+ strlcat(szBuffer, "<", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThan") == 0)
- strcat(szBuffer, ">");
+ strlcat(szBuffer, ">", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThanOrEqualTo") == 0)
- strcat(szBuffer, "<=");
+ strlcat(szBuffer, "<=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThanOrEqualTo") == 0)
- strcat(szBuffer, ">=");
+ strlcat(szBuffer, ">=", bufferSize);
- strcat(szBuffer, " ");
+ strlcat(szBuffer, " ", bufferSize);
/* value */
@@ -3387,23 +3398,33 @@
psFilterNode->psRightNode->pOther &&
(*(int *)psFilterNode->psRightNode->pOther) == 1)
{
- sprintf(szTmp, "lower('%s') ", psFilterNode->psRightNode->pszValue);
- strcat(szBuffer, szTmp);
+ snprintf(szTmp, sizeof(szTmp), "lower('%s') ", psFilterNode->psRightNode->pszValue);
+ strlcat(szBuffer, szTmp, bufferSize);
}
else
{
if (bString)
- strcat(szBuffer, "'");
+ strlcat(szBuffer, "'", bufferSize);
if (psFilterNode->psRightNode->pszValue)
- strcat(szBuffer, psFilterNode->psRightNode->pszValue);
+ {
+ if (bString)
+ {
+ char* pszEscapedStr;
+ pszEscapedStr = msLayerEscapeSQLParam(lp, psFilterNode->psRightNode->pszValue);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+ }
+ else
+ strlcat(szBuffer, psFilterNode->psRightNode->pszValue, bufferSize);
+ }
if (bString)
- strcat(szBuffer, "'");
-
+ strlcat(szBuffer, "'", bufferSize);
}
/*closing bracket*/
- strcat(szBuffer, ") ");
+ strlcat(szBuffer, ") ", bufferSize);
return strdup(szBuffer);
}
@@ -3417,13 +3438,14 @@
char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode,
layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char **aszBounds = NULL;
int nBounds = 0;
int bString=0;
char szTmp[256];
+ char* pszEscapedStr;
-
szBuffer[0] = '\0';
if (!psFilterNode ||
!(strcasecmp(psFilterNode->pszValue, "PropertyIsBetween") == 0))
@@ -3467,32 +3489,46 @@
/* build expresssion. */
/* -------------------------------------------------------------------- */
/*opening paranthesis */
- strcat(szBuffer, " (");
+ strlcat(szBuffer, " (",bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ pszEscapedStr = msLayerEscapePropertyName(lp, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
+
/*between*/
- strcat(szBuffer, " BETWEEN ");
+ strlcat(szBuffer, " BETWEEN ",bufferSize);
/*bound 1*/
if (bString)
- strcat(szBuffer,"'");
- strcat(szBuffer, aszBounds[0]);
+ strlcat(szBuffer,"'",bufferSize);
+
+ pszEscapedStr = msLayerEscapeSQLParam( lp, aszBounds[0]);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+
if (bString)
- strcat(szBuffer,"'");
+ strlcat(szBuffer,"'",bufferSize);
- strcat(szBuffer, " AND ");
+ strlcat(szBuffer, " AND ",bufferSize);
/*bound 2*/
if (bString)
- strcat(szBuffer, "'");
- strcat(szBuffer, aszBounds[1]);
+ strlcat(szBuffer, "'",bufferSize);
+
+ pszEscapedStr = msLayerEscapeSQLParam( lp, aszBounds[1]);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+
if (bString)
- strcat(szBuffer,"'");
+ strlcat(szBuffer,"'",bufferSize);
/*closing paranthesis*/
- strcat(szBuffer, ")");
+ strlcat(szBuffer, ")",bufferSize);
return strdup(szBuffer);
@@ -3506,6 +3542,7 @@
char *FLTGetIsBetweenComparisonExpresssion(FilterEncodingNode *psFilterNode,
layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char **aszBounds = NULL;
int nBounds = 0;
@@ -3526,7 +3563,10 @@
/* -------------------------------------------------------------------- */
aszBounds = msStringSplit(psFilterNode->psRightNode->pszValue, ';', &nBounds);
if (nBounds != 2)
+ {
+ msFreeCharArray(aszBounds, nBounds);
return NULL;
+ }
/* -------------------------------------------------------------------- */
/* check if the value is a numeric value or alphanumeric. If it */
/* is alphanumeric, add quotes around attribute and values. */
@@ -3537,9 +3577,9 @@
const char* pszOFGType;
snprintf(szTmp, sizeof(szTmp), "%s_type", psFilterNode->psLeftNode->pszValue);
pszOFGType = msOWSLookupMetadata(&(lp->metadata), "OFG", szTmp);
- if (pszOFGType != NULL && strcasecmp(pszOFGType, "Character") == 0)
+ if (pszOFGType!= NULL && strcasecmp(pszOFGType, "Character") == 0)
bString = 1;
- else if (FLTIsNumeric(aszBounds[0]) == MS_FALSE)
+ else if (FLTIsNumeric(aszBounds[0]) == MS_FALSE)
bString = 1;
}
if (!bString)
@@ -3556,50 +3596,51 @@
/* build expresssion. */
/* -------------------------------------------------------------------- */
if (bString)
- strcat(szBuffer, " (\"[");
+ strlcat(szBuffer, " (\"[", bufferSize);
else
- strcat(szBuffer, " ([");
+ strlcat(szBuffer, " ([", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "]\" ");
+ strlcat(szBuffer, "]\" ", bufferSize);
else
- strcat(szBuffer, "] ");
+ strlcat(szBuffer, "] ", bufferSize);
- strcat(szBuffer, " >= ");
+ strlcat(szBuffer, " >= ", bufferSize);
if (bString)
- strcat(szBuffer,"\"");
- strcat(szBuffer, aszBounds[0]);
+ strlcat(szBuffer,"\"", bufferSize);
+ strlcat(szBuffer, aszBounds[0], bufferSize);
if (bString)
- strcat(szBuffer,"\"");
+ strlcat(szBuffer,"\"", bufferSize);
- strcat(szBuffer, " AND ");
+ strlcat(szBuffer, " AND ", bufferSize);
if (bString)
- strcat(szBuffer, " \"[");
+ strlcat(szBuffer, " \"[", bufferSize);
else
- strcat(szBuffer, " [");
+ strlcat(szBuffer, " [", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "]\" ");
+ strlcat(szBuffer, "]\" ", bufferSize);
else
- strcat(szBuffer, "] ");
+ strlcat(szBuffer, "] ", bufferSize);
- strcat(szBuffer, " <= ");
+ strlcat(szBuffer, " <= ", bufferSize);
if (bString)
- strcat(szBuffer,"\"");
- strcat(szBuffer, aszBounds[1]);
+ strlcat(szBuffer,"\"", bufferSize);
+ strlcat(szBuffer, aszBounds[1], bufferSize);
if (bString)
- strcat(szBuffer,"\"");
- strcat(szBuffer, ")");
-
-
+ strlcat(szBuffer,"\"", bufferSize);
+ strlcat(szBuffer, ")", bufferSize);
+
+ msFreeCharArray(aszBounds, nBounds);
+
return strdup(szBuffer);
}
@@ -3610,6 +3651,7 @@
/************************************************************************/
char *FLTGetIsLikeComparisonExpression(FilterEncodingNode *psFilterNode)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char *pszValue = NULL;
@@ -3657,43 +3699,49 @@
}
for (i=0; i<nLength; i++)
{
- if (pszValue[i] != pszWild[0] &&
- pszValue[i] != pszSingle[0] &&
- pszValue[i] != pszEscape[0])
+ if (iBuffer < 1024)
{
- szBuffer[iBuffer] = pszValue[i];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
- }
- else if (pszValue[i] == pszSingle[0])
- {
- szBuffer[iBuffer] = '.';
- iBuffer++;
- szBuffer[iBuffer] = '\0';
- }
- else if (pszValue[i] == pszEscape[0])
- {
- szBuffer[iBuffer] = '\\';
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ if (pszValue[i] != pszWild[0] &&
+ pszValue[i] != pszSingle[0] &&
+ pszValue[i] != pszEscape[0])
+ {
+ szBuffer[iBuffer] = pszValue[i];
+ iBuffer++;
+ szBuffer[iBuffer] = '\0';
+ }
+ else if (pszValue[i] == pszSingle[0])
+ {
+ szBuffer[iBuffer] = '.';
+ iBuffer++;
+ szBuffer[iBuffer] = '\0';
+ }
+ else if (pszValue[i] == pszEscape[0])
+ {
+ szBuffer[iBuffer] = '\\';
+ iBuffer++;
+ szBuffer[iBuffer] = '\0';
+ }
+ else if (pszValue[i] == pszWild[0])
+ {
+ /* strcat(szBuffer, "[0-9,a-z,A-Z,\\s]*"); */
+ /* iBuffer+=17; */
+ strlcat(szBuffer, ".*",bufferSize);
+ iBuffer+=2;
+ szBuffer[iBuffer] = '\0';
+ }
}
- else if (pszValue[i] == pszWild[0])
- {
- /* strcat(szBuffer, "[0-9,a-z,A-Z,\\s]*"); */
- /* iBuffer+=17; */
- strcat(szBuffer, ".*");
- iBuffer+=2;
- szBuffer[iBuffer] = '\0';
- }
}
- szBuffer[iBuffer] = '/';
- if (bCaseInsensitive == 1)
+
+ if (iBuffer < 1024)
{
- szBuffer[++iBuffer] = 'i';
- }
- szBuffer[++iBuffer] = '\0';
-
+ szBuffer[iBuffer] = '/';
+ if (bCaseInsensitive == 1)
+ {
+ szBuffer[++iBuffer] = 'i';
+ }
+ szBuffer[++iBuffer] = '\0';
+ }
return strdup(szBuffer);
}
@@ -3704,8 +3752,9 @@
/* Build an sql expression for IsLike filter. */
/************************************************************************/
char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode,
- int connectiontype)
+ layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char *pszValue = NULL;
@@ -3714,9 +3763,11 @@
char *pszEscape = NULL;
char szTmp[4];
- int nLength=0, i=0, iBuffer = 0;
+ int nLength=0, i=0, j=0;
int bCaseInsensitive = 0;
+ char *pszEscapedStr = NULL;
+
if (!psFilterNode || !psFilterNode->pOther || !psFilterNode->psLeftNode ||
!psFilterNode->psRightNode || !psFilterNode->psRightNode->pszValue)
return NULL;
@@ -3735,60 +3786,80 @@
szBuffer[0] = '\0';
/*opening bracket*/
- strcat(szBuffer, " (");
+ strlcat(szBuffer, " (", bufferSize);
/* attribute name */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
- if (bCaseInsensitive == 1 && connectiontype == MS_POSTGIS)
- strcat(szBuffer, " ilike '");
+ pszEscapedStr = msLayerEscapePropertyName(lp, psFilterNode->psLeftNode->pszValue);
+
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
+
+
+ if (bCaseInsensitive == 1 && lp->connectiontype == MS_POSTGIS)
+ strlcat(szBuffer, " ilike '",bufferSize);
else
- strcat(szBuffer, " like '");
+ strlcat(szBuffer, " like '",bufferSize);
pszValue = psFilterNode->psRightNode->pszValue;
nLength = strlen(pszValue);
- iBuffer = strlen(szBuffer);
+
+ pszEscapedStr = (char*) malloc( 3 * nLength + 1);
+
for (i=0; i<nLength; i++)
{
- if (pszValue[i] != pszWild[0] &&
- pszValue[i] != pszSingle[0] &&
- pszValue[i] != pszEscape[0])
+ char c = pszValue[i];
+ if (c != pszWild[0] &&
+ c != pszSingle[0] &&
+ c != pszEscape[0])
{
- szBuffer[iBuffer] = pszValue[i];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ if (c == '\'')
+ {
+ pszEscapedStr[j++] = '\'';
+ pszEscapedStr[j++] = '\'';
+ }
+ else if (c == '\\')
+ {
+ pszEscapedStr[j++] = '\\';
+ pszEscapedStr[j++] = '\\';
+ }
+ else
+ pszEscapedStr[j++] = c;
}
- else if (pszValue[i] == pszSingle[0])
+ else if (c == pszSingle[0])
{
- szBuffer[iBuffer] = '_';
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ pszEscapedStr[j++] = '_';
}
- else if (pszValue[i] == pszEscape[0])
+ else if (c == pszEscape[0])
{
- szBuffer[iBuffer] = pszEscape[0];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
- /*if (i<nLength-1)
+ pszEscapedStr[j++] = pszEscape[0];
+ if (i+1<nLength)
{
- szBuffer[iBuffer] = pszValue[i+1];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ char nextC = pszValue[i+1];
+ i++;
+ if (nextC == '\'')
+ {
+ pszEscapedStr[j++] = '\'';
+ pszEscapedStr[j++] = '\'';
+ }
+ else
+ pszEscapedStr[j++] = nextC;
}
- */
}
- else if (pszValue[i] == pszWild[0])
+ else if (c == pszWild[0])
{
- strcat(szBuffer, "%");
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ pszEscapedStr[j++] = '%';
}
}
+ pszEscapedStr[j++] = 0;
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
- strcat(szBuffer, "'");
- if (connectiontype != MS_OGR)
+ strlcat(szBuffer, "'",bufferSize);
+ if (lp->connectiontype != MS_OGR)
{
- strcat(szBuffer, " escape '");
+ strlcat(szBuffer, " escape '",bufferSize);
szTmp[0] = pszEscape[0];
if (pszEscape[0] == '\\')
{
@@ -3802,9 +3873,9 @@
szTmp[2] = '\0';
}
- strcat(szBuffer, szTmp);
+ strlcat(szBuffer, szTmp,bufferSize);
}
- strcat(szBuffer, ") ");
+ strlcat(szBuffer, ") ",bufferSize);
return strdup(szBuffer);
}
@@ -4115,7 +4186,7 @@
{
if (!lp->items[i] || strlen(lp->items[i]) <= 0)
continue;
- sprintf(szTmp, "%s_alias", lp->items[i]);
+ snprintf(szTmp, sizeof(szTmp), "%s_alias", lp->items[i]);
pszFullName = msOWSLookupMetadata(&(lp->metadata), namespaces, szTmp);
if (pszFullName)
{
Modified: branches/branch-5-6/mapserver/mapogcfilter.h
===================================================================
--- branches/branch-5-6/mapserver/mapogcfilter.h 2011-07-12 13:06:14 UTC (rev 11890)
+++ branches/branch-5-6/mapserver/mapogcfilter.h 2011-07-12 13:09:18 UTC (rev 11891)
@@ -113,8 +113,8 @@
MS_DLL_EXPORT char *FLTGetSQLExpression(FilterEncodingNode *psFilterNode,layerObj *lp);
MS_DLL_EXPORT char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp);
MS_DLL_EXPORT char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp);
-MS_DLL_EXPORT char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode,
- int connectiontype);
+MS_DLL_EXPORT char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode, layerObj *lp);
+
MS_DLL_EXPORT char *FLTGetLogicalComparisonSQLExpresssion(FilterEncodingNode *psFilterNode,
layerObj *lp);
MS_DLL_EXPORT int FLTIsSimpleFilter(FilterEncodingNode *psFilterNode);
Modified: branches/branch-5-6/mapserver/mapogcsos.c
===================================================================
--- branches/branch-5-6/mapserver/mapogcsos.c 2011-07-12 13:06:14 UTC (rev 11890)
+++ branches/branch-5-6/mapserver/mapogcsos.c 2011-07-12 13:09:18 UTC (rev 11891)
@@ -1820,6 +1820,7 @@
char *pszProcedureValue = NULL;
int iItemPosition, status;
shapeObj sShape;
+ char* pszEscapedStr = NULL;
sBbox = map->extent;
@@ -2051,15 +2052,25 @@
pszBuffer = msStringConcatenate(pszBuffer, "(");
if (!bSpatialDB)
- pszBuffer = msStringConcatenate(pszBuffer, "'[");
+ {
+ pszBuffer = msStringConcatenate(pszBuffer, "'[");
+ pszBuffer = msStringConcatenate(pszBuffer, (char *)pszProcedureItem);
+ }
+ else
+ {
+ pszEscapedStr = msLayerEscapePropertyName(lp, (char *)pszProcedureItem);
+ pszBuffer = msStringConcatenate(pszBuffer, pszEscapedStr);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
+ }
- pszBuffer = msStringConcatenate(pszBuffer, (char *)pszProcedureItem);
-
if (!bSpatialDB)
pszBuffer = msStringConcatenate(pszBuffer, "]'");
pszBuffer = msStringConcatenate(pszBuffer, " = '");
- pszBuffer = msStringConcatenate(pszBuffer, tokens[j]);
+ pszEscapedStr = msLayerEscapeSQLParam(lp, tokens[j]);
+ pszBuffer = msStringConcatenate(pszBuffer, pszEscapedStr);
+ msFree(pszEscapedStr);
pszBuffer = msStringConcatenate(pszBuffer, "')");
}
Modified: branches/branch-5-6/mapserver/mapogr.cpp
===================================================================
--- branches/branch-5-6/mapserver/mapogr.cpp 2011-07-12 13:06:14 UTC (rev 11890)
+++ branches/branch-5-6/mapserver/mapogr.cpp 2011-07-12 13:09:18 UTC (rev 11891)
@@ -3471,6 +3471,66 @@
}
/************************************************************************/
+/* msOGREscapeSQLParam */
+/************************************************************************/
+char *msOGREscapeSQLParam(layerObj *layer, const char *pszString)
+{
+ char* pszEscapedStr =NULL;
+#ifdef USE_OGR
+ if(layer && pszString && strlen(pszString) > 0)
+ {
+ char* pszEscapedOGRStr = CPLEscapeString(pszString, strlen(pszString),
+ CPLES_SQL );
+ pszEscapedStr = strdup(pszEscapedOGRStr);
+ CPLFree(pszEscapedOGRStr);
+ return pszEscapedStr;
+ }
+#else
+/* ------------------------------------------------------------------
+ * OGR Support not included...
+ * ------------------------------------------------------------------ */
+
+ msSetError(MS_MISCERR, "OGR support is not available.",
+ "msOGREscapeSQLParam()");
+ return NULL;
+
+#endif /* USE_OGR */
+}
+
+
+/************************************************************************/
+/* msOGREscapeSQLParam */
+/************************************************************************/
+char *msOGREscapePropertyName(layerObj *layer, const char *pszString)
+{
+ char* pszEscapedStr =NULL;
+ int i =0;
+#ifdef USE_OGR
+ if(layer && pszString && strlen(pszString) > 0)
+ {
+ unsigned char ch;
+ for(i=0; (ch = ((unsigned char*)pszString)[i]) != '\0'; i++)
+ {
+ if ( !(isalnum(ch) || ch == '_' || ch > 127) )
+ {
+ return strdup("invalid_property_name");
+ }
+ }
+ pszEscapedStr = strdup(pszString);
+ }
+ return pszEscapedStr;
+#else
+/* ------------------------------------------------------------------
+ * OGR Support not included...
+ * ------------------------------------------------------------------ */
+
+ msSetError(MS_MISCERR, "OGR support is not available.",
+ "msOGREscapePropertyName()");
+ return NULL;
+
+#endif /* USE_OGR */
+}
+/************************************************************************/
/* msOGRLayerInitializeVirtualTable() */
/************************************************************************/
int
@@ -3497,6 +3557,9 @@
/* layer->vtable->LayerCreateItems, use default */
/* layer->vtable->LayerGetNumFeatures, use default */
+ layer->vtable->LayerEscapeSQLParam = msOGREscapeSQLParam;
+ layer->vtable->LayerEscapePropertyName = msOGREscapePropertyName;
+
return MS_SUCCESS;
}
Modified: branches/branch-5-6/mapserver/mappostgis.c
===================================================================
--- branches/branch-5-6/mapserver/mappostgis.c 2011-07-12 13:06:14 UTC (rev 11890)
+++ branches/branch-5-6/mapserver/mappostgis.c 2011-07-12 13:09:18 UTC (rev 11891)
@@ -549,7 +549,7 @@
return(MS_FAILURE);
}
- pgresult = PQexec(layerinfo->pgconn, sql);
+ pgresult = PQexecParams(layerinfo->pgconn, sql,0, NULL, NULL, NULL, NULL, 0);
if ( !pgresult || PQresultStatus(pgresult) != PGRES_TUPLES_OK) {
char *tmp1;
char *tmp2 = NULL;
@@ -1774,7 +1774,7 @@
msDebug("msPostGISLayerWhichShapes query: %s\n", strSQL);
}
- pgresult = PQexec(layerinfo->pgconn, strSQL);
+ pgresult = PQexecParams(layerinfo->pgconn, strSQL,0, NULL, NULL, NULL, NULL, 0);
if ( layer->debug > 1 ) {
msDebug("msPostGISLayerWhichShapes query status: %s (%d)\n", PQresStatus(PQresultStatus(pgresult)), PQresultStatus(pgresult));
@@ -1979,7 +1979,7 @@
msDebug("msPostGISLayerGetShape query: %s\n", strSQL);
}
- pgresult = PQexec(layerinfo->pgconn, strSQL);
+ pgresult = PQexecParams(layerinfo->pgconn, strSQL,0, NULL, NULL, NULL, NULL, 0);
/* Something went wrong. */
if ( (!pgresult) || (PQresultStatus(pgresult) != PGRES_TUPLES_OK) ) {
@@ -2073,7 +2073,7 @@
msDebug("msPostGISLayerGetItems executing SQL: %s\n", sql);
}
- pgresult = PQexec(layerinfo->pgconn, sql);
+ pgresult = PQexecParams(layerinfo->pgconn, sql,0, NULL, NULL, NULL, NULL, 0);
if ( (!pgresult) || (PQresultStatus(pgresult) != PGRES_TUPLES_OK) ) {
msSetError(MS_QUERYERR, "Error (%s) executing SQL: %s", "msPostGISLayerGetItems()", PQerrorMessage(layerinfo->pgconn), sql);
Modified: branches/branch-5-6/mapserver/mapserver.h
===================================================================
--- branches/branch-5-6/mapserver/mapserver.h 2011-07-12 13:06:14 UTC (rev 11890)
+++ branches/branch-5-6/mapserver/mapserver.h 2011-07-12 13:09:18 UTC (rev 11891)
@@ -1556,6 +1556,8 @@
int (*LayerCreateItems)(layerObj *layer, int nt);
int (*LayerGetNumFeatures)(layerObj *layer);
+ char* (*LayerEscapeSQLParam)(layerObj *layer, const char* pszString);
+ char* (*LayerEscapePropertyName)(layerObj *layer, const char* pszString);
};
#endif /*SWIG*/
@@ -1955,6 +1957,9 @@
/* maplayer.c */
MS_DLL_EXPORT int msLayerGetNumFeatures(layerObj *layer);
+MS_DLL_EXPORT char *msLayerEscapeSQLParam(layerObj *layer, const char* pszString);
+MS_DLL_EXPORT char *msLayerEscapePropertyName(layerObj *layer, const char* pszString);
+
/* These are special because SWF is using these */
int msOGRLayerNextShape(layerObj *layer, shapeObj *shape);
int msOGRLayerGetItems(layerObj *layer);
More information about the mapserver-commits
mailing list