[mapserver-commits] r11893 - branches/branch-5-2/mapserver
svn at osgeo.org
svn at osgeo.org
Tue Jul 12 09:13:38 EDT 2011
Author: assefa
Date: 2011-07-12 06:13:38 -0700 (Tue, 12 Jul 2011)
New Revision: 11893
Modified:
branches/branch-5-2/mapserver/HISTORY.TXT
branches/branch-5-2/mapserver/maplayer.c
branches/branch-5-2/mapserver/mapogcfilter.c
branches/branch-5-2/mapserver/mapogcfilter.h
branches/branch-5-2/mapserver/mapogcsos.c
branches/branch-5-2/mapserver/mapogr.cpp
branches/branch-5-2/mapserver/mappostgis.c
branches/branch-5-2/mapserver/mapserver.h
Log:
Security fixes (#3903)
Modified: branches/branch-5-2/mapserver/HISTORY.TXT
===================================================================
--- branches/branch-5-2/mapserver/HISTORY.TXT 2011-07-12 13:11:40 UTC (rev 11892)
+++ branches/branch-5-2/mapserver/HISTORY.TXT 2011-07-12 13:13:38 UTC (rev 11893)
@@ -11,7 +11,14 @@
Current Version:
----------------
+IMPORTANT SECURITY FIXE:
+- Fixes to prevent SQL injections through OGC filter encoding (in WMS, WFS
+ and SOS), as well as a potential SQL injection in WMS time support.
+ Your system may be vulnerable if it has MapServer with OGC protocols
+ enabled, with layers connecting to an SQL RDBMS backend, either
+ natively or via OGR (#3903)
+
- WFS: check if map projection is properly set before using it (#3897)
- Disabled some insecure (and potentially exploitable) mapserv command-line
Modified: branches/branch-5-2/mapserver/maplayer.c
===================================================================
--- branches/branch-5-2/mapserver/maplayer.c 2011-07-12 13:11:40 UTC (rev 11892)
+++ branches/branch-5-2/mapserver/maplayer.c 2011-07-12 13:13:38 UTC (rev 11893)
@@ -1,5 +1,5 @@
/******************************************************************************
- * $Id:$
+ * $Id$
*
* Project: MapServer
* Purpose: Implementation of most layerObj functions.
@@ -1080,6 +1080,85 @@
return MS_FAILURE;
}
+
+/************************************************************************/
+/* LayerDefaultEscapeSQLParam */
+/* */
+/* Default function used to escape strings and avoid sql */
+/* injection. Specific drivers should redefine if an escaping */
+/* function is available in the driver. */
+/************************************************************************/
+char *LayerDefaultEscapeSQLParam(layerObj *layer, const char* pszString)
+{
+ char *pszEscapedStr=NULL;
+ if (pszString)
+ {
+ int nSrcLen;
+ char c;
+ int i=0, j=0;
+ nSrcLen = (int)strlen(pszString);
+ pszEscapedStr = (char*) malloc( 2 * nSrcLen + 1);
+ for(i = 0, j = 0; i < nSrcLen; i++)
+ {
+ c = pszString[i];
+ if (c == '\'')
+ {
+ pszEscapedStr[j++] = '\'';
+ pszEscapedStr[j++] = '\'';
+ }
+ else if (c == '\\')
+ {
+ pszEscapedStr[j++] = '\\';
+ pszEscapedStr[j++] = '\\';
+ }
+ else
+ pszEscapedStr[j++] = c;
+ }
+ pszEscapedStr[j] = 0;
+ }
+ return pszEscapedStr;
+}
+
+/************************************************************************/
+/* LayerDefaultEscapePropertyName */
+/* */
+/* Return the property name in a properly escaped and quoted form. */
+/************************************************************************/
+char *LayerDefaultEscapePropertyName(layerObj *layer, const char* pszString)
+{
+ char* pszEscapedStr=NULL;
+ int i, j = 0;
+
+ if (layer && pszString && strlen(pszString) > 0)
+ {
+ int nLength = strlen(pszString);
+
+ pszEscapedStr = (char*) malloc( 1 + 2 * nLength + 1 + 1);
+ pszEscapedStr[j++] = '"';
+
+ for (i=0; i<nLength; i++)
+ {
+ char c = pszString[i];
+ if (c == '"')
+ {
+ pszEscapedStr[j++] = '"';
+ pszEscapedStr[j++] ='"';
+ }
+ else if (c == '\\')
+ {
+ pszEscapedStr[j++] = '\\';
+ pszEscapedStr[j++] = '\\';
+ }
+ else
+ pszEscapedStr[j++] = c;
+ }
+ pszEscapedStr[j++] = '"';
+ pszEscapedStr[j++] = 0;
+
+ }
+ return pszEscapedStr;
+}
+
/*
* msConnectLayer
*
@@ -1137,6 +1216,10 @@
vtable->LayerGetNumFeatures = LayerDefaultGetNumFeatures;
+ vtable->LayerEscapeSQLParam = LayerDefaultEscapeSQLParam;
+
+ vtable->LayerEscapePropertyName = LayerDefaultEscapePropertyName;
+
return MS_SUCCESS;
}
@@ -1301,6 +1384,31 @@
return i;
}
+
+/*
+Returns an escaped string
+*/
+char *msLayerEscapeSQLParam(layerObj *layer, const char*pszString)
+{
+ if ( ! layer->vtable) {
+ int rv = msInitializeVirtualTable(layer);
+ if (rv != MS_SUCCESS)
+ return "";
+ }
+ return layer->vtable->LayerEscapeSQLParam(layer, pszString);
+}
+
+char *msLayerEscapePropertyName(layerObj *layer, const char*pszString)
+{
+ if ( ! layer->vtable) {
+ int rv = msInitializeVirtualTable(layer);
+ if (rv != MS_SUCCESS)
+ return "";
+ }
+ return layer->vtable->LayerEscapePropertyName(layer, pszString);
+}
+
+
int
msINLINELayerInitializeVirtualTable(layerObj *layer)
{
@@ -1332,5 +1440,8 @@
/* layer->vtable->LayerCreateItems, use default */
layer->vtable->LayerGetNumFeatures = msINLINELayerGetNumFeatures;
+ /*layer->vtable->LayerEscapeSQLParam, use default*/
+ /*layer->vtable->LayerEscapePropertyName, use default*/
+
return MS_SUCCESS;
}
Modified: branches/branch-5-2/mapserver/mapogcfilter.c
===================================================================
--- branches/branch-5-2/mapserver/mapogcfilter.c 2011-07-12 13:11:40 UTC (rev 11892)
+++ branches/branch-5-2/mapserver/mapogcfilter.c 2011-07-12 13:13:38 UTC (rev 11893)
@@ -131,7 +131,7 @@
if (tokens && nTokens == 2)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%s",tokens[1]);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%s",tokens[1]);
msInitProjection(psProj);
if (msLoadProjectionString(psProj, szTmp) == 0)
nStatus = MS_TRUE;
@@ -156,7 +156,7 @@
if (nEpsgTmp > 0)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%d",nEpsgTmp);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%d",nEpsgTmp);
msInitProjection(psProj);
if (msLoadProjectionString(psProj, szTmp) == 0)
nStatus = MS_TRUE;
@@ -917,7 +917,7 @@
if (tokens && nTokens == 2)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%s",tokens[1]);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%s",tokens[1]);
msInitProjection(&sProjTmp);
if (msLoadProjectionString(&sProjTmp, szTmp) == 0)
msProjectRect(&sProjTmp, &map->projection, &sQueryRect);
@@ -942,7 +942,7 @@
if (nEpsgTmp > 0)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%d",nEpsgTmp);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%d",nEpsgTmp);
msInitProjection(&sProjTmp);
if (msLoadProjectionString(&sProjTmp, szTmp) == 0)
msProjectRect(&sProjTmp, &map->projection, &sQueryRect);
@@ -2689,9 +2689,9 @@
}
}
if (bString)
- sprintf(szTmp, "('[%s]' = '%s')" , pszAttribute, tokens[i]);
+ snprintf(szTmp, sizeof(szTmp),"('[%s]' = '%s')" , pszAttribute, tokens[i]);
else
- sprintf(szTmp, "([%s] = %s)" , pszAttribute, tokens[i]);
+ snprintf(szTmp, sizeof(szTmp), "([%s] = %s)" , pszAttribute, tokens[i]);
if (pszExpression != NULL)
pszExpression = msStringConcatenate(pszExpression, " OR ");
@@ -2744,20 +2744,20 @@
if (FLTIsBinaryComparisonFilterType(psFilterNode->pszValue))
{
pszExpression =
- FLTGetBinaryComparisonSQLExpresssion(psFilterNode);
+ FLTGetBinaryComparisonSQLExpresssion(psFilterNode, lp);
}
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsBetween") == 0)
{
pszExpression =
- FLTGetIsBetweenComparisonSQLExpresssion(psFilterNode);
+ FLTGetIsBetweenComparisonSQLExpresssion(psFilterNode, lp);
}
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLike") == 0)
{
pszExpression =
- FLTGetIsLikeComparisonSQLExpression(psFilterNode,
- connectiontype);
+ FLTGetIsLikeComparisonSQLExpression(psFilterNode, lp);
+
}
}
}
@@ -2796,6 +2796,7 @@
{
for (i=0; i<nTokens; i++)
{
+ char *pszEscapedStr = NULL;
if (i == 0)
{
pszTmp = tokens[0];
@@ -2809,11 +2810,15 @@
}
}
}
+ pszEscapedStr = msLayerEscapeSQLParam(lp, tokens[i]);
if (bString)
- sprintf(szTmp, "(%s = '%s')" , pszAttribute, tokens[i]);
+ snprintf(szTmp, sizeof(szTmp), "(%s = '%s')" , pszAttribute, pszEscapedStr);
else
- sprintf(szTmp, "(%s = %s)" , pszAttribute, tokens[i]);
+ snprintf(szTmp, sizeof(szTmp), "(%s = %s)" , pszAttribute, pszEscapedStr);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+
if (pszExpression != NULL)
pszExpression = msStringConcatenate(pszExpression, " OR ");
pszExpression = msStringConcatenate(pszExpression, szTmp);
@@ -3090,6 +3095,7 @@
/************************************************************************/
char *FLTGetBinaryComparisonExpresssion(FilterEncodingNode *psFilterNode)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
int i=0, bString=0, nLenght = 0;
@@ -3124,16 +3130,16 @@
if (bString)
- strcat(szBuffer, " (\"[");
+ strlcat(szBuffer, " (\"[", bufferSize);
else
- strcat(szBuffer, " ([");
+ strlcat(szBuffer, " ([", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "]\" ");
+ strlcat(szBuffer, "]\" ", bufferSize);
else
- strcat(szBuffer, "] ");
+ strlcat(szBuffer, "] ", bufferSize);
/* logical operator */
@@ -3144,40 +3150,40 @@
if (psFilterNode->psRightNode->pOther &&
(*(int *)psFilterNode->psRightNode->pOther) == 1)
{
- strcat(szBuffer, "IEQ");
+ strlcat(szBuffer, "IEQ", bufferSize);
}
else
- strcat(szBuffer, "=");
+ strlcat(szBuffer, "=", bufferSize);
}
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsNotEqualTo") == 0)
- strcat(szBuffer, "!=");
+ strlcat(szBuffer, "!=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThan") == 0)
- strcat(szBuffer, "<");
+ strlcat(szBuffer, "<", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThan") == 0)
- strcat(szBuffer, ">");
+ strlcat(szBuffer, ">", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThanOrEqualTo") == 0)
- strcat(szBuffer, "<=");
+ strlcat(szBuffer, "<=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThanOrEqualTo") == 0)
- strcat(szBuffer, ">=");
+ strlcat(szBuffer, ">=", bufferSize);
- strcat(szBuffer, " ");
+ strlcat(szBuffer, " ", bufferSize);
/* value */
if (bString)
- strcat(szBuffer, "\"");
+ strlcat(szBuffer, "\"", bufferSize);
if (psFilterNode->psRightNode->pszValue)
- strcat(szBuffer, psFilterNode->psRightNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psRightNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "\"");
+ strlcat(szBuffer, "\"", bufferSize);
- strcat(szBuffer, ") ");
+ strlcat(szBuffer, ") ", bufferSize);
return strdup(szBuffer);
}
@@ -3189,11 +3195,14 @@
/* */
/* Return the expression for a binary comparison filter node. */
/************************************************************************/
-char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode)
+char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode,
+ layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
int i=0, bString=0, nLenght = 0;
char szTmp[100];
+ char* pszEscapedStr = NULL;
szBuffer[0] = '\0';
if (!psFilterNode || !
@@ -3227,8 +3236,10 @@
/*opening bracket*/
- strcat(szBuffer, " (");
+ strlcat(szBuffer, " (", bufferSize);
+ pszEscapedStr = msLayerEscapePropertyName(lp, psFilterNode->psLeftNode->pszValue);
+
/* attribute */
/*case insensitive set ? */
if (bString &&
@@ -3237,35 +3248,37 @@
psFilterNode->psRightNode->pOther &&
(*(int *)psFilterNode->psRightNode->pOther) == 1)
{
- sprintf(szTmp, "lower(%s) ", psFilterNode->psLeftNode->pszValue);
- strcat(szBuffer, szTmp);
+ snprintf(szTmp, sizeof(szTmp), "lower(%s) ", pszEscapedStr);
+ strlcat(szBuffer, szTmp, bufferSize);
}
else
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
/* logical operator */
if (strcasecmp(psFilterNode->pszValue,
"PropertyIsEqualTo") == 0)
- strcat(szBuffer, "=");
+ strlcat(szBuffer, "=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsNotEqualTo") == 0)
- strcat(szBuffer, "<>");
+ strlcat(szBuffer, "<>", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThan") == 0)
- strcat(szBuffer, "<");
+ strlcat(szBuffer, "<", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThan") == 0)
- strcat(szBuffer, ">");
+ strlcat(szBuffer, ">", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThanOrEqualTo") == 0)
- strcat(szBuffer, "<=");
+ strlcat(szBuffer, "<=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThanOrEqualTo") == 0)
- strcat(szBuffer, ">=");
+ strlcat(szBuffer, ">=", bufferSize);
- strcat(szBuffer, " ");
+ strlcat(szBuffer, " ", bufferSize);
/* value */
@@ -3276,23 +3289,34 @@
psFilterNode->psRightNode->pOther &&
(*(int *)psFilterNode->psRightNode->pOther) == 1)
{
- sprintf(szTmp, "lower('%s') ", psFilterNode->psRightNode->pszValue);
- strcat(szBuffer, szTmp);
+ snprintf(szTmp, sizeof(szTmp), "lower('%s') ", psFilterNode->psRightNode->pszValue);
+ strlcat(szBuffer, szTmp, bufferSize);
}
else
{
if (bString)
- strcat(szBuffer, "'");
+ strlcat(szBuffer, "'", bufferSize);
if (psFilterNode->psRightNode->pszValue)
- strcat(szBuffer, psFilterNode->psRightNode->pszValue);
+ {
+ if (bString)
+ {
+ char* pszEscapedStr;
+ pszEscapedStr = msLayerEscapeSQLParam(lp, psFilterNode->psRightNode->pszValue);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+ }
+ else
+ strlcat(szBuffer, psFilterNode->psRightNode->pszValue, bufferSize);
+ }
if (bString)
- strcat(szBuffer, "'");
+ strlcat(szBuffer, "'", bufferSize);
}
/*closing bracket*/
- strcat(szBuffer, ") ");
+ strlcat(szBuffer, ") ", bufferSize);
return strdup(szBuffer);
}
@@ -3303,14 +3327,15 @@
/* */
/* Build an SQL expresssion for IsBteween Filter. */
/************************************************************************/
-char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode)
+char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char **aszBounds = NULL;
int nBounds = 0;
int i=0, bString=0, nLenght = 0;
+ char* pszEscapedStr;
-
szBuffer[0] = '\0';
if (!psFilterNode ||
!(strcasecmp(psFilterNode->pszValue, "PropertyIsBetween") == 0))
@@ -3363,32 +3388,47 @@
/* build expresssion. */
/* -------------------------------------------------------------------- */
/*opening paranthesis */
- strcat(szBuffer, " (");
+ strlcat(szBuffer, " (", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ pszEscapedStr = msLayerEscapePropertyName(lp, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
+
+
/*between*/
- strcat(szBuffer, " BETWEEN ");
+ strlcat(szBuffer, " BETWEEN ", bufferSize);
/*bound 1*/
if (bString)
- strcat(szBuffer,"'");
- strcat(szBuffer, aszBounds[0]);
+ strlcat(szBuffer,"'", bufferSize);
+
+ pszEscapedStr = msLayerEscapeSQLParam( lp, aszBounds[0]);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+
if (bString)
- strcat(szBuffer,"'");
+ strlcat(szBuffer,"'", bufferSize);
- strcat(szBuffer, " AND ");
+ strlcat(szBuffer, " AND ", bufferSize);
/*bound 2*/
if (bString)
- strcat(szBuffer, "'");
- strcat(szBuffer, aszBounds[1]);
+ strlcat(szBuffer, "'", bufferSize);
+
+ pszEscapedStr = msLayerEscapeSQLParam( lp, aszBounds[1]);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+
if (bString)
- strcat(szBuffer,"'");
+ strlcat(szBuffer,"'", bufferSize);
/*closing paranthesis*/
- strcat(szBuffer, ")");
+ strlcat(szBuffer, ")", bufferSize);
return strdup(szBuffer);
@@ -3401,6 +3441,7 @@
/************************************************************************/
char *FLTGetIsBetweenComparisonExpresssion(FilterEncodingNode *psFilterNode)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char **aszBounds = NULL;
int nBounds = 0;
@@ -3459,48 +3500,48 @@
/* build expresssion. */
/* -------------------------------------------------------------------- */
if (bString)
- strcat(szBuffer, " (\"[");
+ strlcat(szBuffer, " (\"[", bufferSize);
else
- strcat(szBuffer, " ([");
+ strlcat(szBuffer, " ([", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "]\" ");
+ strlcat(szBuffer, "]\" ", bufferSize);
else
- strcat(szBuffer, "] ");
+ strlcat(szBuffer, "] ", bufferSize);
- strcat(szBuffer, " >= ");
+ strlcat(szBuffer, " >= ", bufferSize);
if (bString)
- strcat(szBuffer,"\"");
- strcat(szBuffer, aszBounds[0]);
+ strlcat(szBuffer,"\"", bufferSize);
+ strlcat(szBuffer, aszBounds[0], bufferSize);
if (bString)
- strcat(szBuffer,"\"");
+ strlcat(szBuffer,"\"", bufferSize);
- strcat(szBuffer, " AND ");
+ strlcat(szBuffer, " AND ", bufferSize);
if (bString)
- strcat(szBuffer, " \"[");
+ strlcat(szBuffer, " \"[", bufferSize);
else
- strcat(szBuffer, " [");
+ strlcat(szBuffer, " [", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "]\" ");
+ strlcat(szBuffer, "]\" ", bufferSize);
else
- strcat(szBuffer, "] ");
+ strlcat(szBuffer, "] ", bufferSize);
- strcat(szBuffer, " <= ");
+ strlcat(szBuffer, " <= ", bufferSize);
if (bString)
- strcat(szBuffer,"\"");
- strcat(szBuffer, aszBounds[1]);
+ strlcat(szBuffer,"\"", bufferSize);
+ strlcat(szBuffer, aszBounds[1], bufferSize);
if (bString)
- strcat(szBuffer,"\"");
- strcat(szBuffer, ")");
+ strlcat(szBuffer,"\"", bufferSize);
+ strlcat(szBuffer, ")", bufferSize);
return strdup(szBuffer);
@@ -3513,6 +3554,7 @@
/************************************************************************/
char *FLTGetIsLikeComparisonExpression(FilterEncodingNode *psFilterNode)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char *pszValue = NULL;
@@ -3560,43 +3602,48 @@
}
for (i=0; i<nLength; i++)
{
- if (pszValue[i] != pszWild[0] &&
- pszValue[i] != pszSingle[0] &&
- pszValue[i] != pszEscape[0])
- {
- szBuffer[iBuffer] = pszValue[i];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
- }
- else if (pszValue[i] == pszSingle[0])
- {
- szBuffer[iBuffer] = '.';
- iBuffer++;
- szBuffer[iBuffer] = '\0';
- }
- else if (pszValue[i] == pszEscape[0])
- {
- szBuffer[iBuffer] = '\\';
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ if (iBuffer < 1024)
+ {
+ if (pszValue[i] != pszWild[0] &&
+ pszValue[i] != pszSingle[0] &&
+ pszValue[i] != pszEscape[0])
+ {
+ szBuffer[iBuffer] = pszValue[i];
+ iBuffer++;
+ szBuffer[iBuffer] = '\0';
+ }
+ else if (pszValue[i] == pszSingle[0])
+ {
+ szBuffer[iBuffer] = '.';
+ iBuffer++;
+ szBuffer[iBuffer] = '\0';
+ }
+ else if (pszValue[i] == pszEscape[0])
+ {
+ szBuffer[iBuffer] = '\\';
+ iBuffer++;
+ szBuffer[iBuffer] = '\0';
+ }
+ else if (pszValue[i] == pszWild[0])
+ {
+ /* strcat(szBuffer, "[0-9,a-z,A-Z,\\s]*"); */
+ /* iBuffer+=17; */
+ strlcat(szBuffer, ".*", bufferSize);
+ iBuffer+=2;
+ szBuffer[iBuffer] = '\0';
+ }
}
- else if (pszValue[i] == pszWild[0])
+ }
+ if (iBuffer < 1024)
+ {
+ szBuffer[iBuffer] = '/';
+ if (bCaseInsensitive == 1)
{
- /* strcat(szBuffer, "[0-9,a-z,A-Z,\\s]*"); */
- /* iBuffer+=17; */
- strcat(szBuffer, ".*");
- iBuffer+=2;
- szBuffer[iBuffer] = '\0';
- }
- }
- szBuffer[iBuffer] = '/';
- if (bCaseInsensitive == 1)
- {
- szBuffer[++iBuffer] = 'i';
- }
- szBuffer[++iBuffer] = '\0';
-
+ szBuffer[++iBuffer] = 'i';
+ }
+ szBuffer[++iBuffer] = '\0';
+ }
return strdup(szBuffer);
}
@@ -3606,9 +3653,9 @@
/* */
/* Build an sql expression for IsLike filter. */
/************************************************************************/
-char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode,
- int connectiontype)
+char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode, layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char *pszValue = NULL;
@@ -3617,9 +3664,11 @@
char *pszEscape = NULL;
char szTmp[3];
- int nLength=0, i=0, iBuffer = 0;
+ int nLength=0, i=0, j=0;
int bCaseInsensitive = 0;
+ char *pszEscapedStr = NULL;
+
if (!psFilterNode || !psFilterNode->pOther || !psFilterNode->psLeftNode ||
!psFilterNode->psRightNode || !psFilterNode->psRightNode->pszValue)
return NULL;
@@ -3638,60 +3687,78 @@
szBuffer[0] = '\0';
/*opening bracket*/
- strcat(szBuffer, " (");
+ strlcat(szBuffer, " (", bufferSize);
/* attribute name */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
- if (bCaseInsensitive == 1 && connectiontype == MS_POSTGIS)
- strcat(szBuffer, " ilike '");
+ pszEscapedStr = msLayerEscapePropertyName(lp, psFilterNode->psLeftNode->pszValue);
+
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
+
+ if (bCaseInsensitive == 1 && lp->connectiontype == MS_POSTGIS)
+ strlcat(szBuffer, " ilike '", bufferSize);
else
- strcat(szBuffer, " like '");
+ strlcat(szBuffer, " like '", bufferSize);
pszValue = psFilterNode->psRightNode->pszValue;
nLength = strlen(pszValue);
- iBuffer = strlen(szBuffer);
+
+ pszEscapedStr = (char*) malloc( 3 * nLength + 1);
for (i=0; i<nLength; i++)
{
- if (pszValue[i] != pszWild[0] &&
- pszValue[i] != pszSingle[0] &&
- pszValue[i] != pszEscape[0])
+ char c = pszValue[i];
+ if (c != pszWild[0] &&
+ c != pszSingle[0] &&
+ c != pszEscape[0])
{
- szBuffer[iBuffer] = pszValue[i];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ if (c == '\'')
+ {
+ pszEscapedStr[j++] = '\'';
+ pszEscapedStr[j++] = '\'';
+ }
+ else if (c == '\\')
+ {
+ pszEscapedStr[j++] = '\\';
+ pszEscapedStr[j++] = '\\';
+ }
+ else
+ pszEscapedStr[j++] = c;
}
- else if (pszValue[i] == pszSingle[0])
+ else if (c == pszSingle[0])
{
- szBuffer[iBuffer] = '_';
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ pszEscapedStr[j++] = '_';
}
- else if (pszValue[i] == pszEscape[0])
+ else if (c == pszEscape[0])
{
- szBuffer[iBuffer] = pszEscape[0];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
- /*if (i<nLength-1)
+ pszEscapedStr[j++] = pszEscape[0];
+ if (i+1<nLength)
{
- szBuffer[iBuffer] = pszValue[i+1];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ char nextC = pszValue[i+1];
+ i++;
+ if (nextC == '\'')
+ {
+ pszEscapedStr[j++] = '\'';
+ pszEscapedStr[j++] = '\'';
+ }
+ else
+ pszEscapedStr[j++] = nextC;
}
- */
}
- else if (pszValue[i] == pszWild[0])
+ else if (c == pszWild[0])
{
- strcat(szBuffer, "%");
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ pszEscapedStr[j++] = '%';
}
}
+ pszEscapedStr[j++] = 0;
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
- strcat(szBuffer, "'");
- if (connectiontype != MS_OGR)
+ strlcat(szBuffer, "'", bufferSize);
+ if (lp->connectiontype != MS_OGR)
{
- strcat(szBuffer, " escape '");
+ strlcat(szBuffer, " escape '", bufferSize);
szTmp[0] = pszEscape[0];
if (pszEscape[0] == '\\')
{
@@ -3705,9 +3772,9 @@
szTmp[2] = '\0';
}
- strcat(szBuffer, szTmp);
+ strlcat(szBuffer, szTmp, bufferSize);
}
- strcat(szBuffer, ") ");
+ strlcat(szBuffer, ") ", bufferSize);
return strdup(szBuffer);
}
@@ -4018,7 +4085,7 @@
{
if (!lp->items[i] || strlen(lp->items[i]) <= 0)
continue;
- sprintf(szTmp, "%s_alias", lp->items[i]);
+ snprintf(szTmp, sizeof(szTmp), "%s_alias", lp->items[i]);
pszFullName = msOWSLookupMetadata(&(lp->metadata), namespaces, szTmp);
if (pszFullName)
{
Modified: branches/branch-5-2/mapserver/mapogcfilter.h
===================================================================
--- branches/branch-5-2/mapserver/mapogcfilter.h 2011-07-12 13:11:40 UTC (rev 11892)
+++ branches/branch-5-2/mapserver/mapogcfilter.h 2011-07-12 13:13:38 UTC (rev 11893)
@@ -111,10 +111,10 @@
int iLayerIndex);
MS_DLL_EXPORT char *FLTGetSQLExpression(FilterEncodingNode *psFilterNode,layerObj *lp);
-MS_DLL_EXPORT char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode);
-MS_DLL_EXPORT char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode);
-MS_DLL_EXPORT char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode,
- int connectiontype);
+MS_DLL_EXPORT char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp);
+MS_DLL_EXPORT char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp);
+MS_DLL_EXPORT char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode, layerObj *lp);
+
MS_DLL_EXPORT char *FLTGetLogicalComparisonSQLExpresssion(FilterEncodingNode *psFilterNode,
layerObj *lp);
MS_DLL_EXPORT int FLTIsSimpleFilter(FilterEncodingNode *psFilterNode);
Modified: branches/branch-5-2/mapserver/mapogcsos.c
===================================================================
--- branches/branch-5-2/mapserver/mapogcsos.c 2011-07-12 13:11:40 UTC (rev 11892)
+++ branches/branch-5-2/mapserver/mapogcsos.c 2011-07-12 13:13:38 UTC (rev 11893)
@@ -1779,6 +1779,7 @@
char *pszProcedureValue = NULL;
int iItemPosition, status;
shapeObj sShape;
+ char* pszEscapedStr = NULL;
sBbox = map->extent;
@@ -2001,15 +2002,25 @@
pszBuffer = msStringConcatenate(pszBuffer, "(");
if (!bSpatialDB)
- pszBuffer = msStringConcatenate(pszBuffer, "'[");
+ {
+ pszBuffer = msStringConcatenate(pszBuffer, "'[");
+ pszBuffer = msStringConcatenate(pszBuffer, (char *)pszProcedureItem);
+ }
+ else
+ {
+ pszEscapedStr = msLayerEscapePropertyName(lp, (char *)pszProcedureItem);
+ pszBuffer = msStringConcatenate(pszBuffer, pszEscapedStr);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
+ }
- pszBuffer = msStringConcatenate(pszBuffer, (char *)pszProcedureItem);
-
if (!bSpatialDB)
pszBuffer = msStringConcatenate(pszBuffer, "]'");
pszBuffer = msStringConcatenate(pszBuffer, " = '");
- pszBuffer = msStringConcatenate(pszBuffer, tokens[j]);
+ pszEscapedStr = msLayerEscapeSQLParam(lp, tokens[j]);
+ pszBuffer = msStringConcatenate(pszBuffer, pszEscapedStr);
+ msFree(pszEscapedStr);
pszBuffer = msStringConcatenate(pszBuffer, "')");
}
Modified: branches/branch-5-2/mapserver/mapogr.cpp
===================================================================
--- branches/branch-5-2/mapserver/mapogr.cpp 2011-07-12 13:11:40 UTC (rev 11892)
+++ branches/branch-5-2/mapserver/mapogr.cpp 2011-07-12 13:13:38 UTC (rev 11893)
@@ -2698,6 +2698,66 @@
}
/************************************************************************/
+/* msOGREscapeSQLParam */
+/************************************************************************/
+char *msOGREscapeSQLParam(layerObj *layer, const char *pszString)
+{
+ char* pszEscapedStr =NULL;
+#ifdef USE_OGR
+ if(layer && pszString && strlen(pszString) > 0)
+ {
+ char* pszEscapedOGRStr = CPLEscapeString(pszString, strlen(pszString),
+ CPLES_SQL );
+ pszEscapedStr = strdup(pszEscapedOGRStr);
+ CPLFree(pszEscapedOGRStr);
+ return pszEscapedStr;
+ }
+#else
+/* ------------------------------------------------------------------
+ * OGR Support not included...
+ * ------------------------------------------------------------------ */
+
+ msSetError(MS_MISCERR, "OGR support is not available.",
+ "msOGREscapeSQLParam()");
+ return NULL;
+
+#endif /* USE_OGR */
+}
+
+
+/************************************************************************/
+/* msOGREscapeSQLParam */
+/************************************************************************/
+char *msOGREscapePropertyName(layerObj *layer, const char *pszString)
+{
+ char* pszEscapedStr =NULL;
+ int i =0;
+#ifdef USE_OGR
+ if(layer && pszString && strlen(pszString) > 0)
+ {
+ unsigned char ch;
+ for(i=0; (ch = ((unsigned char*)pszString)[i]) != '\0'; i++)
+ {
+ if ( !(isalnum(ch) || ch == '_' || ch > 127) )
+ {
+ return strdup("invalid_property_name");
+ }
+ }
+ pszEscapedStr = strdup(pszString);
+ }
+ return pszEscapedStr;
+#else
+/* ------------------------------------------------------------------
+ * OGR Support not included...
+ * ------------------------------------------------------------------ */
+
+ msSetError(MS_MISCERR, "OGR support is not available.",
+ "msOGREscapePropertyName()");
+ return NULL;
+
+#endif /* USE_OGR */
+}
+/************************************************************************/
/* msOGRLayerInitializeVirtualTable() */
/************************************************************************/
int
@@ -2728,6 +2788,9 @@
/* layer->vtable->LayerGetNumFeatures, use default */
+ layer->vtable->LayerEscapeSQLParam = msOGREscapeSQLParam;
+ layer->vtable->LayerEscapePropertyName = msOGREscapePropertyName;
+
return MS_SUCCESS;
}
Modified: branches/branch-5-2/mapserver/mappostgis.c
===================================================================
--- branches/branch-5-2/mapserver/mappostgis.c 2011-07-12 13:11:40 UTC (rev 11892)
+++ branches/branch-5-2/mapserver/mappostgis.c 2011-07-12 13:13:38 UTC (rev 11893)
@@ -580,7 +580,7 @@
if(layer->debug) {
msDebug("query_string_0_6:%s\n", query_string_0_6);
}
- result = PQexec(layerinfo->conn, query_string_0_6);
+ result = PQexecParams(layerinfo->conn, query_string_0_6,0, NULL, NULL, NULL, NULL, 0);
if(!result || PQresultStatus(result) != PGRES_COMMAND_OK)
{
@@ -1263,7 +1263,7 @@
free(geom_column_name);
free(table_name);
- query_result = PQexec(layerinfo->conn, query_str);
+ query_result = PQexecParams(layerinfo->conn, query_str,0, NULL, NULL, NULL, NULL, 0);
if(!query_result || PQresultStatus(query_result) != PGRES_COMMAND_OK) {
msSetError(MS_QUERYERR, "Error executing POSTGIS SQL statement (in FETCH ALL): %s\n-%s\nMore Help:", "msPOSTGISLayerGetShape()", query_str, PQerrorMessage(layerinfo->conn));
@@ -1455,7 +1455,7 @@
/* geom_column_name is needed later */
free(table_name);
- query_result = PQexec(layerinfo->conn, sql);
+ query_result = PQexecParams(layerinfo->conn, sql,0, NULL, NULL, NULL, NULL, 0);
if(!query_result || PQresultStatus(query_result) != PGRES_TUPLES_OK) {
msSetError(MS_QUERYERR, "Error executing POSTGIS SQL statement (in msPOSTGISLayerGetItems): %s\n-%s\n", "msPOSTGISLayerGetItems()", sql, PQerrorMessage(layerinfo->conn));
Modified: branches/branch-5-2/mapserver/mapserver.h
===================================================================
--- branches/branch-5-2/mapserver/mapserver.h 2011-07-12 13:11:40 UTC (rev 11892)
+++ branches/branch-5-2/mapserver/mapserver.h 2011-07-12 13:13:38 UTC (rev 11893)
@@ -1416,6 +1416,8 @@
int (*LayerCreateItems)(layerObj *layer, int nt);
int (*LayerGetNumFeatures)(layerObj *layer);
+ char* (*LayerEscapeSQLParam)(layerObj *layer, const char* pszString);
+ char* (*LayerEscapePropertyName)(layerObj *layer, const char* pszString);
};
#endif /*SWIG*/
@@ -1788,6 +1790,9 @@
/* maplayer.c */
MS_DLL_EXPORT int msLayerGetNumFeatures(layerObj *layer);
+MS_DLL_EXPORT char *msLayerEscapeSQLParam(layerObj *layer, const char* pszString);
+MS_DLL_EXPORT char *msLayerEscapePropertyName(layerObj *layer, const char* pszString);
+
/* These are special because SWF is using these */
int msOGRLayerNextShape(layerObj *layer, shapeObj *shape);
int msOGRLayerGetItems(layerObj *layer);
More information about the mapserver-commits
mailing list