[mapserver-commits] r11897 - branches/branch-4-10/mapserver
svn at osgeo.org
svn at osgeo.org
Tue Jul 12 09:19:08 EDT 2011
Author: assefa
Date: 2011-07-12 06:19:08 -0700 (Tue, 12 Jul 2011)
New Revision: 11897
Modified:
branches/branch-4-10/mapserver/HISTORY.TXT
branches/branch-4-10/mapserver/map.h
branches/branch-4-10/mapserver/maplayer.c
branches/branch-4-10/mapserver/mapogcfilter.c
branches/branch-4-10/mapserver/mapogcfilter.h
branches/branch-4-10/mapserver/mapogr.cpp
branches/branch-4-10/mapserver/mappostgis.c
Log:
Security fixes (#3903)
Modified: branches/branch-4-10/mapserver/HISTORY.TXT
===================================================================
--- branches/branch-4-10/mapserver/HISTORY.TXT 2011-07-12 13:17:28 UTC (rev 11896)
+++ branches/branch-4-10/mapserver/HISTORY.TXT 2011-07-12 13:19:08 UTC (rev 11897)
@@ -9,7 +9,18 @@
For a complete change history, please see the Subversion log comments.
+Current Version:
+----------------
+IMPORTANT SECURITY FIXE:
+
+- Fixes to prevent SQL injections through OGC filter encoding (in WMS, WFS
+ and SOS), as well as a potential SQL injection in WMS time support.
+ Your system may be vulnerable if it has MapServer with OGC protocols
+ enabled, with layers connecting to an SQL RDBMS backend, either
+ natively or via OGR (#3903)
+
+
Version 4.10.6 (2010-07-09)
---------------------------
Modified: branches/branch-4-10/mapserver/map.h
===================================================================
--- branches/branch-4-10/mapserver/map.h 2011-07-12 13:17:28 UTC (rev 11896)
+++ branches/branch-4-10/mapserver/map.h 2011-07-12 13:19:08 UTC (rev 11897)
@@ -1199,6 +1199,8 @@
int (*LayerCreateItems)(layerObj *layer, int nt);
int (*LayerGetNumFeatures)(layerObj *layer);
+ char* (*LayerEscapeSQLParam)(layerObj *layer, const char* pszString);
+ char* (*LayerEscapePropertyName)(layerObj *layer, const char* pszString);
};
#endif /*SWIG*/
@@ -1528,6 +1530,9 @@
/* maplayer.c */
MS_DLL_EXPORT int msLayerGetNumFeatures(layerObj *layer);
+MS_DLL_EXPORT char *msLayerEscapeSQLParam(layerObj *layer, const char* pszString);
+MS_DLL_EXPORT char *msLayerEscapePropertyName(layerObj *layer, const char* pszString);
+
/* These are special because SWF is using these */
int msOGRLayerNextShape(layerObj *layer, shapeObj *shape);
int msOGRLayerGetItems(layerObj *layer);
Modified: branches/branch-4-10/mapserver/maplayer.c
===================================================================
--- branches/branch-4-10/mapserver/maplayer.c 2011-07-12 13:17:28 UTC (rev 11896)
+++ branches/branch-4-10/mapserver/maplayer.c 2011-07-12 13:19:08 UTC (rev 11897)
@@ -1133,6 +1133,85 @@
return MS_FAILURE;
}
+
+/************************************************************************/
+/* LayerDefaultEscapeSQLParam */
+/* */
+/* Default function used to escape strings and avoid sql */
+/* injection. Specific drivers should redefine if an escaping */
+/* function is available in the driver. */
+/************************************************************************/
+char *LayerDefaultEscapeSQLParam(layerObj *layer, const char* pszString)
+{
+ char *pszEscapedStr=NULL;
+ if (pszString)
+ {
+ int nSrcLen;
+ char c;
+ int i=0, j=0;
+ nSrcLen = (int)strlen(pszString);
+ pszEscapedStr = (char*) malloc( 2 * nSrcLen + 1);
+ for(i = 0, j = 0; i < nSrcLen; i++)
+ {
+ c = pszString[i];
+ if (c == '\'')
+ {
+ pszEscapedStr[j++] = '\'';
+ pszEscapedStr[j++] = '\'';
+ }
+ else if (c == '\\')
+ {
+ pszEscapedStr[j++] = '\\';
+ pszEscapedStr[j++] = '\\';
+ }
+ else
+ pszEscapedStr[j++] = c;
+ }
+ pszEscapedStr[j] = 0;
+ }
+ return pszEscapedStr;
+}
+
+/************************************************************************/
+/* LayerDefaultEscapePropertyName */
+/* */
+/* Return the property name in a properly escaped and quoted form. */
+/************************************************************************/
+char *LayerDefaultEscapePropertyName(layerObj *layer, const char* pszString)
+{
+ char* pszEscapedStr=NULL;
+ int i, j = 0;
+
+ if (layer && pszString && strlen(pszString) > 0)
+ {
+ int nLength = strlen(pszString);
+
+ pszEscapedStr = (char*) malloc( 1 + 2 * nLength + 1 + 1);
+ pszEscapedStr[j++] = '"';
+
+ for (i=0; i<nLength; i++)
+ {
+ char c = pszString[i];
+ if (c == '"')
+ {
+ pszEscapedStr[j++] = '"';
+ pszEscapedStr[j++] ='"';
+ }
+ else if (c == '\\')
+ {
+ pszEscapedStr[j++] = '\\';
+ pszEscapedStr[j++] = '\\';
+ }
+ else
+ pszEscapedStr[j++] = c;
+ }
+ pszEscapedStr[j++] = '"';
+ pszEscapedStr[j++] = 0;
+
+ }
+ return pszEscapedStr;
+}
+
/*
* msConnectLayer
*
@@ -1190,6 +1269,10 @@
vtable->LayerGetNumFeatures = LayerDefaultGetNumFeatures;
+ vtable->LayerEscapeSQLParam = LayerDefaultEscapeSQLParam;
+
+ vtable->LayerEscapePropertyName = LayerDefaultEscapePropertyName;
+
return MS_SUCCESS;
}
@@ -1354,6 +1437,31 @@
return i;
}
+
+/*
+Returns an escaped string
+*/
+char *msLayerEscapeSQLParam(layerObj *layer, const char*pszString)
+{
+ if ( ! layer->vtable) {
+ int rv = msInitializeVirtualTable(layer);
+ if (rv != MS_SUCCESS)
+ return "";
+ }
+ return layer->vtable->LayerEscapeSQLParam(layer, pszString);
+}
+
+char *msLayerEscapePropertyName(layerObj *layer, const char*pszString)
+{
+ if ( ! layer->vtable) {
+ int rv = msInitializeVirtualTable(layer);
+ if (rv != MS_SUCCESS)
+ return "";
+ }
+ return layer->vtable->LayerEscapePropertyName(layer, pszString);
+}
+
+
int
msINLINELayerInitializeVirtualTable(layerObj *layer)
{
@@ -1385,5 +1493,8 @@
/* layer->vtable->LayerCreateItems, use default */
layer->vtable->LayerGetNumFeatures = msINLINELayerGetNumFeatures;
+ /*layer->vtable->LayerEscapeSQLParam, use default*/
+ /*layer->vtable->LayerEscapePropertyName, use default*/
+
return MS_SUCCESS;
}
Modified: branches/branch-4-10/mapserver/mapogcfilter.c
===================================================================
--- branches/branch-4-10/mapserver/mapogcfilter.c 2011-07-12 13:17:28 UTC (rev 11896)
+++ branches/branch-4-10/mapserver/mapogcfilter.c 2011-07-12 13:19:08 UTC (rev 11897)
@@ -448,7 +448,7 @@
if (tokens && nTokens == 2)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%s",tokens[1]);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%s",tokens[1]);
msInitProjection(&sProjTmp);
if (msLoadProjectionString(&sProjTmp, szTmp) == 0)
msProjectRect(&sProjTmp, &map->projection, &sQueryRect);
@@ -473,7 +473,7 @@
if (nEpsgTmp > 0)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%d",nEpsgTmp);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%d",nEpsgTmp);
msInitProjection(&sProjTmp);
if (msLoadProjectionString(&sProjTmp, szTmp) == 0)
msProjectRect(&sProjTmp, &map->projection, &sQueryRect);
@@ -995,7 +995,7 @@
if (tokens && nTokens == 2)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%s",tokens[1]);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%s",tokens[1]);
msInitProjection(&sProjTmp);
if (msLoadProjectionString(&sProjTmp, szTmp) == 0)
msProjectRect(&sProjTmp, &map->projection, &sQueryRect);
@@ -1020,7 +1020,7 @@
if (nEpsgTmp > 0)
{
char szTmp[32];
- sprintf(szTmp, "init=epsg:%d",nEpsgTmp);
+ snprintf(szTmp, sizeof(szTmp), "init=epsg:%d",nEpsgTmp);
msInitProjection(&sProjTmp);
if (msLoadProjectionString(&sProjTmp, szTmp) == 0)
msProjectRect( &sProjTmp, &map->projection, &sQueryRect);
@@ -1036,7 +1036,7 @@
lp->class[0].type = lp->type;
lp->class[0].template = strdup("ttt.html");
- szExpression = FLTGetSQLExpression(psNode, lp->connectiontype);
+ szExpression = FLTGetSQLExpression(psNode, lp);
if (szExpression)
{
pszBuffer = (char *)malloc(sizeof(char) * (strlen(szExpression) + 8));
@@ -2638,7 +2638,7 @@
/* */
/* Build SQL expressions from the mapserver nodes. */
/************************************************************************/
-char *FLTGetSQLExpression(FilterEncodingNode *psFilterNode, int connectiontype)
+char *FLTGetSQLExpression(FilterEncodingNode *psFilterNode, layerObj *lp)
{
char *pszExpression = NULL;
@@ -2652,20 +2652,20 @@
if (FLTIsBinaryComparisonFilterType(psFilterNode->pszValue))
{
pszExpression =
- FLTGetBinaryComparisonSQLExpresssion(psFilterNode);
+ FLTGetBinaryComparisonSQLExpresssion(psFilterNode, lp);
}
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsBetween") == 0)
{
pszExpression =
- FLTGetIsBetweenComparisonSQLExpresssion(psFilterNode);
+ FLTGetIsBetweenComparisonSQLExpresssion(psFilterNode, lp);
}
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLike") == 0)
{
pszExpression =
- FLTGetIsLikeComparisonSQLExpression(psFilterNode,
- connectiontype);
+ FLTGetIsLikeComparisonSQLExpression(psFilterNode, lp);
+
}
}
}
@@ -2676,14 +2676,13 @@
strcasecmp(psFilterNode->pszValue, "OR") == 0)
{
pszExpression =
- FLTGetLogicalComparisonSQLExpresssion(psFilterNode,
- connectiontype);
+ FLTGetLogicalComparisonSQLExpresssion(psFilterNode, lp);
+
}
else if (strcasecmp(psFilterNode->pszValue, "NOT") == 0)
{
pszExpression =
- FLTGetLogicalComparisonSQLExpresssion(psFilterNode,
- connectiontype);
+ FLTGetLogicalComparisonSQLExpresssion(psFilterNode,lp);
}
}
@@ -2728,8 +2727,7 @@
/* */
/* Return the expression for logical comparison expression. */
/************************************************************************/
-char *FLTGetLogicalComparisonSQLExpresssion(FilterEncodingNode *psFilterNode,
- int connectiontype)
+char *FLTGetLogicalComparisonSQLExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp)
{
char *pszBuffer = NULL;
char *pszTmp = NULL;
@@ -2744,9 +2742,9 @@
(strcasecmp(psFilterNode->psRightNode->pszValue, "BBOX") == 0)))
{
if (strcasecmp(psFilterNode->psLeftNode->pszValue, "BBOX") != 0)
- pszTmp = FLTGetSQLExpression(psFilterNode->psLeftNode, connectiontype);
+ pszTmp = FLTGetSQLExpression(psFilterNode->psLeftNode, lp);
else
- pszTmp = FLTGetSQLExpression(psFilterNode->psRightNode, connectiontype);
+ pszTmp = FLTGetSQLExpression(psFilterNode->psRightNode, lp);
if (!pszTmp)
return NULL;
@@ -2760,7 +2758,7 @@
/* -------------------------------------------------------------------- */
else if (psFilterNode->psLeftNode && psFilterNode->psRightNode)
{
- pszTmp = FLTGetSQLExpression(psFilterNode->psLeftNode, connectiontype);
+ pszTmp = FLTGetSQLExpression(psFilterNode->psLeftNode, lp);
if (!pszTmp)
return NULL;
@@ -2777,7 +2775,7 @@
free( pszTmp );
nTmp = strlen(pszBuffer);
- pszTmp = FLTGetSQLExpression(psFilterNode->psRightNode, connectiontype);
+ pszTmp = FLTGetSQLExpression(psFilterNode->psRightNode, lp);
if (!pszTmp)
return NULL;
@@ -2792,7 +2790,7 @@
else if (psFilterNode->psLeftNode &&
strcasecmp(psFilterNode->pszValue, "NOT") == 0)
{
- pszTmp = FLTGetSQLExpression(psFilterNode->psLeftNode, connectiontype);
+ pszTmp = FLTGetSQLExpression(psFilterNode->psLeftNode, lp);
if (!pszTmp)
return NULL;
@@ -2949,6 +2947,7 @@
/************************************************************************/
char *FLTGetBinaryComparisonExpresssion(FilterEncodingNode *psFilterNode)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
int i=0, bString=0, nLenght = 0;
@@ -2983,16 +2982,16 @@
if (bString)
- strcat(szBuffer, " (\"[");
+ strlcat(szBuffer, " (\"[", bufferSize);
else
- strcat(szBuffer, " ([");
+ strlcat(szBuffer, " ([", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "]\" ");
+ strlcat(szBuffer, "]\" ", bufferSize);
else
- strcat(szBuffer, "] ");
+ strlcat(szBuffer, "] ", bufferSize);
/* logical operator */
@@ -3003,40 +3002,40 @@
if (psFilterNode->psRightNode->pOther &&
(*(int *)psFilterNode->psRightNode->pOther) == 1)
{
- strcat(szBuffer, "IEQ");
+ strlcat(szBuffer, "IEQ", bufferSize);
}
else
- strcat(szBuffer, "=");
+ strlcat(szBuffer, "=", bufferSize);
}
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsNotEqualTo") == 0)
- strcat(szBuffer, "!=");
+ strlcat(szBuffer, "!=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThan") == 0)
- strcat(szBuffer, "<");
+ strlcat(szBuffer, "<", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThan") == 0)
- strcat(szBuffer, ">");
+ strlcat(szBuffer, ">", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThanOrEqualTo") == 0)
- strcat(szBuffer, "<=");
+ strlcat(szBuffer, "<=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThanOrEqualTo") == 0)
- strcat(szBuffer, ">=");
+ strlcat(szBuffer, ">=", bufferSize);
- strcat(szBuffer, " ");
+ strlcat(szBuffer, " ", bufferSize);
/* value */
if (bString)
- strcat(szBuffer, "\"");
+ strlcat(szBuffer, "\"", bufferSize);
if (psFilterNode->psRightNode->pszValue)
- strcat(szBuffer, psFilterNode->psRightNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psRightNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "\"");
+ strlcat(szBuffer, "\"", bufferSize);
- strcat(szBuffer, ") ");
+ strlcat(szBuffer, ") ", bufferSize);
return strdup(szBuffer);
}
@@ -3048,11 +3047,14 @@
/* */
/* Return the expression for a binary comparison filter node. */
/************************************************************************/
-char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode)
+char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode,
+ layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
int i=0, bString=0, nLenght = 0;
char szTmp[100];
+ char* pszEscapedStr = NULL;
szBuffer[0] = '\0';
if (!psFilterNode || !
@@ -3086,8 +3088,10 @@
/*opening bracket*/
- strcat(szBuffer, " (");
+ strlcat(szBuffer, " (", bufferSize);
+ pszEscapedStr = msLayerEscapePropertyName(lp, psFilterNode->psLeftNode->pszValue);
+
/* attribute */
/*case insensitive set ? */
if (bString &&
@@ -3096,35 +3100,37 @@
psFilterNode->psRightNode->pOther &&
(*(int *)psFilterNode->psRightNode->pOther) == 1)
{
- sprintf(szTmp, "lower(%s) ", psFilterNode->psLeftNode->pszValue);
- strcat(szBuffer, szTmp);
+ snprintf(szTmp, sizeof(szTmp), "lower(%s) ", pszEscapedStr);
+ strlcat(szBuffer, szTmp, bufferSize);
}
else
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
/* logical operator */
if (strcasecmp(psFilterNode->pszValue,
"PropertyIsEqualTo") == 0)
- strcat(szBuffer, "=");
+ strlcat(szBuffer, "=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsNotEqualTo") == 0)
- strcat(szBuffer, "<>");
+ strlcat(szBuffer, "<>", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThan") == 0)
- strcat(szBuffer, "<");
+ strlcat(szBuffer, "<", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThan") == 0)
- strcat(szBuffer, ">");
+ strlcat(szBuffer, ">", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsLessThanOrEqualTo") == 0)
- strcat(szBuffer, "<=");
+ strlcat(szBuffer, "<=", bufferSize);
else if (strcasecmp(psFilterNode->pszValue,
"PropertyIsGreaterThanOrEqualTo") == 0)
- strcat(szBuffer, ">=");
+ strlcat(szBuffer, ">=", bufferSize);
- strcat(szBuffer, " ");
+ strlcat(szBuffer, " ", bufferSize);
/* value */
@@ -3135,23 +3141,34 @@
psFilterNode->psRightNode->pOther &&
(*(int *)psFilterNode->psRightNode->pOther) == 1)
{
- sprintf(szTmp, "lower('%s') ", psFilterNode->psRightNode->pszValue);
- strcat(szBuffer, szTmp);
+ snprintf(szTmp, sizeof(szTmp), "lower('%s') ", psFilterNode->psRightNode->pszValue);
+ strlcat(szBuffer, szTmp, bufferSize);
}
else
{
if (bString)
- strcat(szBuffer, "'");
+ strlcat(szBuffer, "'", bufferSize);
if (psFilterNode->psRightNode->pszValue)
- strcat(szBuffer, psFilterNode->psRightNode->pszValue);
+ {
+ if (bString)
+ {
+ char* pszEscapedStr;
+ pszEscapedStr = msLayerEscapeSQLParam(lp, psFilterNode->psRightNode->pszValue);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+ }
+ else
+ strlcat(szBuffer, psFilterNode->psRightNode->pszValue, bufferSize);
+ }
if (bString)
- strcat(szBuffer, "'");
+ strlcat(szBuffer, "'", bufferSize);
}
/*closing bracket*/
- strcat(szBuffer, ") ");
+ strlcat(szBuffer, ") ", bufferSize);
return strdup(szBuffer);
}
@@ -3162,14 +3179,15 @@
/* */
/* Build an SQL expresssion for IsBteween Filter. */
/************************************************************************/
-char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode)
+char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char **aszBounds = NULL;
int nBounds = 0;
int i=0, bString=0, nLenght = 0;
+ char* pszEscapedStr;
-
szBuffer[0] = '\0';
if (!psFilterNode ||
!(strcasecmp(psFilterNode->pszValue, "PropertyIsBetween") == 0))
@@ -3222,32 +3240,47 @@
/* build expresssion. */
/* -------------------------------------------------------------------- */
/*opening paranthesis */
- strcat(szBuffer, " (");
+ strlcat(szBuffer, " (", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ pszEscapedStr = msLayerEscapePropertyName(lp, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr = NULL;
+
+
/*between*/
- strcat(szBuffer, " BETWEEN ");
+ strlcat(szBuffer, " BETWEEN ", bufferSize);
/*bound 1*/
if (bString)
- strcat(szBuffer,"'");
- strcat(szBuffer, aszBounds[0]);
+ strlcat(szBuffer,"'", bufferSize);
+
+ pszEscapedStr = msLayerEscapeSQLParam( lp, aszBounds[0]);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+
if (bString)
- strcat(szBuffer,"'");
+ strlcat(szBuffer,"'", bufferSize);
- strcat(szBuffer, " AND ");
+ strlcat(szBuffer, " AND ", bufferSize);
/*bound 2*/
if (bString)
- strcat(szBuffer, "'");
- strcat(szBuffer, aszBounds[1]);
+ strlcat(szBuffer, "'", bufferSize);
+
+ pszEscapedStr = msLayerEscapeSQLParam( lp, aszBounds[1]);
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
+ pszEscapedStr=NULL;
+
if (bString)
- strcat(szBuffer,"'");
+ strlcat(szBuffer,"'", bufferSize);
/*closing paranthesis*/
- strcat(szBuffer, ")");
+ strlcat(szBuffer, ")", bufferSize);
return strdup(szBuffer);
@@ -3260,6 +3293,7 @@
/************************************************************************/
char *FLTGetIsBetweenComparisonExpresssion(FilterEncodingNode *psFilterNode)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char **aszBounds = NULL;
int nBounds = 0;
@@ -3318,48 +3352,48 @@
/* build expresssion. */
/* -------------------------------------------------------------------- */
if (bString)
- strcat(szBuffer, " (\"[");
+ strlcat(szBuffer, " (\"[", bufferSize);
else
- strcat(szBuffer, " ([");
+ strlcat(szBuffer, " ([", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "]\" ");
+ strlcat(szBuffer, "]\" ", bufferSize);
else
- strcat(szBuffer, "] ");
+ strlcat(szBuffer, "] ", bufferSize);
- strcat(szBuffer, " >= ");
+ strlcat(szBuffer, " >= ", bufferSize);
if (bString)
- strcat(szBuffer,"\"");
- strcat(szBuffer, aszBounds[0]);
+ strlcat(szBuffer,"\"", bufferSize);
+ strlcat(szBuffer, aszBounds[0], bufferSize);
if (bString)
- strcat(szBuffer,"\"");
+ strlcat(szBuffer,"\"", bufferSize);
- strcat(szBuffer, " AND ");
+ strlcat(szBuffer, " AND ", bufferSize);
if (bString)
- strcat(szBuffer, " \"[");
+ strlcat(szBuffer, " \"[", bufferSize);
else
- strcat(szBuffer, " [");
+ strlcat(szBuffer, " [", bufferSize);
/* attribute */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
if (bString)
- strcat(szBuffer, "]\" ");
+ strlcat(szBuffer, "]\" ", bufferSize);
else
- strcat(szBuffer, "] ");
+ strlcat(szBuffer, "] ", bufferSize);
- strcat(szBuffer, " <= ");
+ strlcat(szBuffer, " <= ", bufferSize);
if (bString)
- strcat(szBuffer,"\"");
- strcat(szBuffer, aszBounds[1]);
+ strlcat(szBuffer,"\"", bufferSize);
+ strlcat(szBuffer, aszBounds[1], bufferSize);
if (bString)
- strcat(szBuffer,"\"");
- strcat(szBuffer, ")");
+ strlcat(szBuffer,"\"", bufferSize);
+ strlcat(szBuffer, ")", bufferSize);
return strdup(szBuffer);
@@ -3372,6 +3406,7 @@
/************************************************************************/
char *FLTGetIsLikeComparisonExpression(FilterEncodingNode *psFilterNode)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char *pszValue = NULL;
@@ -3419,43 +3454,48 @@
}
for (i=0; i<nLength; i++)
{
- if (pszValue[i] != pszWild[0] &&
- pszValue[i] != pszSingle[0] &&
- pszValue[i] != pszEscape[0])
- {
- szBuffer[iBuffer] = pszValue[i];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
- }
- else if (pszValue[i] == pszSingle[0])
- {
- szBuffer[iBuffer] = '.';
- iBuffer++;
- szBuffer[iBuffer] = '\0';
- }
- else if (pszValue[i] == pszEscape[0])
- {
- szBuffer[iBuffer] = '\\';
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ if (iBuffer < 1024)
+ {
+ if (pszValue[i] != pszWild[0] &&
+ pszValue[i] != pszSingle[0] &&
+ pszValue[i] != pszEscape[0])
+ {
+ szBuffer[iBuffer] = pszValue[i];
+ iBuffer++;
+ szBuffer[iBuffer] = '\0';
+ }
+ else if (pszValue[i] == pszSingle[0])
+ {
+ szBuffer[iBuffer] = '.';
+ iBuffer++;
+ szBuffer[iBuffer] = '\0';
+ }
+ else if (pszValue[i] == pszEscape[0])
+ {
+ szBuffer[iBuffer] = '\\';
+ iBuffer++;
+ szBuffer[iBuffer] = '\0';
+ }
+ else if (pszValue[i] == pszWild[0])
+ {
+ /* strcat(szBuffer, "[0-9,a-z,A-Z,\\s]*"); */
+ /* iBuffer+=17; */
+ strlcat(szBuffer, ".*", bufferSize);
+ iBuffer+=2;
+ szBuffer[iBuffer] = '\0';
+ }
}
- else if (pszValue[i] == pszWild[0])
+ }
+ if (iBuffer < 1024)
+ {
+ szBuffer[iBuffer] = '/';
+ if (bCaseInsensitive == 1)
{
- /* strcat(szBuffer, "[0-9,a-z,A-Z,\\s]*"); */
- /* iBuffer+=17; */
- strcat(szBuffer, ".*");
- iBuffer+=2;
- szBuffer[iBuffer] = '\0';
- }
- }
- szBuffer[iBuffer] = '/';
- if (bCaseInsensitive == 1)
- {
- szBuffer[++iBuffer] = 'i';
- }
- szBuffer[++iBuffer] = '\0';
-
+ szBuffer[++iBuffer] = 'i';
+ }
+ szBuffer[++iBuffer] = '\0';
+ }
return strdup(szBuffer);
}
@@ -3465,9 +3505,9 @@
/* */
/* Build an sql expression for IsLike filter. */
/************************************************************************/
-char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode,
- int connectiontype)
+char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode, layerObj *lp)
{
+ const size_t bufferSize = 1024;
char szBuffer[1024];
char *pszValue = NULL;
@@ -3476,9 +3516,11 @@
char *pszEscape = NULL;
char szTmp[3];
- int nLength=0, i=0, iBuffer = 0;
+ int nLength=0, i=0, j=0;
int bCaseInsensitive = 0;
+ char *pszEscapedStr = NULL;
+
if (!psFilterNode || !psFilterNode->pOther || !psFilterNode->psLeftNode ||
!psFilterNode->psRightNode || !psFilterNode->psRightNode->pszValue)
return NULL;
@@ -3497,60 +3539,73 @@
szBuffer[0] = '\0';
/*opening bracket*/
- strcat(szBuffer, " (");
+ strlcat(szBuffer, " (", bufferSize);
/* attribute name */
- strcat(szBuffer, psFilterNode->psLeftNode->pszValue);
- if (bCaseInsensitive == 1 && connectiontype != MS_OGR)
- strcat(szBuffer, " ilike '");
+ strlcat(szBuffer, psFilterNode->psLeftNode->pszValue, bufferSize);
+ if (bCaseInsensitive == 1 && lp->connectiontype != MS_OGR)
+ strlcat(szBuffer, " ilike '", bufferSize);
else
- strcat(szBuffer, " like '");
+ strlcat(szBuffer, " like '", bufferSize);
pszValue = psFilterNode->psRightNode->pszValue;
nLength = strlen(pszValue);
- iBuffer = strlen(szBuffer);
+
+ pszEscapedStr = (char*) malloc( 3 * nLength + 1);
for (i=0; i<nLength; i++)
{
- if (pszValue[i] != pszWild[0] &&
- pszValue[i] != pszSingle[0] &&
- pszValue[i] != pszEscape[0])
+ char c = pszValue[i];
+ if (c != pszWild[0] &&
+ c != pszSingle[0] &&
+ c != pszEscape[0])
{
- szBuffer[iBuffer] = pszValue[i];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ if (c == '\'')
+ {
+ pszEscapedStr[j++] = '\'';
+ pszEscapedStr[j++] = '\'';
+ }
+ else if (c == '\\')
+ {
+ pszEscapedStr[j++] = '\\';
+ pszEscapedStr[j++] = '\\';
+ }
+ else
+ pszEscapedStr[j++] = c;
}
- else if (pszValue[i] == pszSingle[0])
+ else if (c == pszSingle[0])
{
- szBuffer[iBuffer] = '_';
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ pszEscapedStr[j++] = '_';
}
- else if (pszValue[i] == pszEscape[0])
+ else if (c == pszEscape[0])
{
- szBuffer[iBuffer] = pszEscape[0];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
- /*if (i<nLength-1)
+ pszEscapedStr[j++] = pszEscape[0];
+ if (i+1<nLength)
{
- szBuffer[iBuffer] = pszValue[i+1];
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ char nextC = pszValue[i+1];
+ i++;
+ if (nextC == '\'')
+ {
+ pszEscapedStr[j++] = '\'';
+ pszEscapedStr[j++] = '\'';
+ }
+ else
+ pszEscapedStr[j++] = nextC;
}
- */
}
- else if (pszValue[i] == pszWild[0])
+ else if (c == pszWild[0])
{
- strcat(szBuffer, "%");
- iBuffer++;
- szBuffer[iBuffer] = '\0';
+ pszEscapedStr[j++] = '%';
}
}
+ pszEscapedStr[j++] = 0;
+ strlcat(szBuffer, pszEscapedStr, bufferSize);
+ msFree(pszEscapedStr);
- strcat(szBuffer, "'");
- if (connectiontype != MS_OGR)
+ strlcat(szBuffer, "'", bufferSize);
+ if (lp->connectiontype != MS_OGR)
{
- strcat(szBuffer, " escape '");
+ strlcat(szBuffer, " escape '", bufferSize);
szTmp[0] = pszEscape[0];
if (pszEscape[0] == '\\')
{
@@ -3564,9 +3619,9 @@
szTmp[2] = '\0';
}
- strcat(szBuffer, szTmp);
+ strlcat(szBuffer, szTmp, bufferSize);
}
- strcat(szBuffer, ") ");
+ strlcat(szBuffer, ") ", bufferSize);
return strdup(szBuffer);
}
Modified: branches/branch-4-10/mapserver/mapogcfilter.h
===================================================================
--- branches/branch-4-10/mapserver/mapogcfilter.h 2011-07-12 13:17:28 UTC (rev 11896)
+++ branches/branch-4-10/mapserver/mapogcfilter.h 2011-07-12 13:19:08 UTC (rev 11897)
@@ -165,13 +165,11 @@
int FLTApplySimpleSQLFilter(FilterEncodingNode *psNode, mapObj *map,
int iLayerIndex);
-char *FLTGetSQLExpression(FilterEncodingNode *psFilterNode,int connectiontype);
-char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode);
-char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode);
-char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode,
- int connectiontype);
-char *FLTGetLogicalComparisonSQLExpresssion(FilterEncodingNode *psFilterNode,
- int connectiontype);
+char *FLTGetSQLExpression(FilterEncodingNode *psFilterNode,layerObj *lp);
+char *FLTGetBinaryComparisonSQLExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp);
+char *FLTGetIsBetweenComparisonSQLExpresssion(FilterEncodingNode *psFilterNode,layerObj *lp);
+char *FLTGetIsLikeComparisonSQLExpression(FilterEncodingNode *psFilterNode, layerObj *lp);
+char *FLTGetLogicalComparisonSQLExpresssion(FilterEncodingNode *psFilterNode, layerObj *lp);
int FLTIsSimpleFilter(FilterEncodingNode *psFilterNode);
Modified: branches/branch-4-10/mapserver/mapogr.cpp
===================================================================
--- branches/branch-4-10/mapserver/mapogr.cpp 2011-07-12 13:17:28 UTC (rev 11896)
+++ branches/branch-4-10/mapserver/mapogr.cpp 2011-07-12 13:19:08 UTC (rev 11897)
@@ -2405,6 +2405,66 @@
}
/************************************************************************/
+/* msOGREscapeSQLParam */
+/************************************************************************/
+char *msOGREscapeSQLParam(layerObj *layer, const char *pszString)
+{
+ char* pszEscapedStr =NULL;
+#ifdef USE_OGR
+ if(layer && pszString && strlen(pszString) > 0)
+ {
+ char* pszEscapedOGRStr = CPLEscapeString(pszString, strlen(pszString),
+ CPLES_SQL );
+ pszEscapedStr = strdup(pszEscapedOGRStr);
+ CPLFree(pszEscapedOGRStr);
+ return pszEscapedStr;
+ }
+#else
+/* ------------------------------------------------------------------
+ * OGR Support not included...
+ * ------------------------------------------------------------------ */
+
+ msSetError(MS_MISCERR, "OGR support is not available.",
+ "msOGREscapeSQLParam()");
+ return NULL;
+
+#endif /* USE_OGR */
+}
+
+
+/************************************************************************/
+/* msOGREscapeSQLParam */
+/************************************************************************/
+char *msOGREscapePropertyName(layerObj *layer, const char *pszString)
+{
+ char* pszEscapedStr =NULL;
+ int i =0;
+#ifdef USE_OGR
+ if(layer && pszString && strlen(pszString) > 0)
+ {
+ unsigned char ch;
+ for(i=0; (ch = ((unsigned char*)pszString)[i]) != '\0'; i++)
+ {
+ if ( !(isalnum(ch) || ch == '_' || ch > 127) )
+ {
+ return strdup("invalid_property_name");
+ }
+ }
+ pszEscapedStr = strdup(pszString);
+ }
+ return pszEscapedStr;
+#else
+/* ------------------------------------------------------------------
+ * OGR Support not included...
+ * ------------------------------------------------------------------ */
+
+ msSetError(MS_MISCERR, "OGR support is not available.",
+ "msOGREscapePropertyName()");
+ return NULL;
+
+#endif /* USE_OGR */
+}
+/************************************************************************/
/* msOGRLayerInitializeVirtualTable() */
/************************************************************************/
int
@@ -2435,6 +2495,9 @@
/* layer->vtable->LayerGetNumFeatures, use default */
+ layer->vtable->LayerEscapeSQLParam = msOGREscapeSQLParam;
+ layer->vtable->LayerEscapePropertyName = msOGREscapePropertyName;
+
return MS_SUCCESS;
}
Modified: branches/branch-4-10/mapserver/mappostgis.c
===================================================================
--- branches/branch-4-10/mapserver/mappostgis.c 2011-07-12 13:17:28 UTC (rev 11896)
+++ branches/branch-4-10/mapserver/mappostgis.c 2011-07-12 13:19:08 UTC (rev 11897)
@@ -614,7 +614,7 @@
if(layer->debug) {
msDebug("query_string_0_6:%s\n", query_string_0_6);
}
- result = PQexec(layerinfo->conn, query_string_0_6);
+ result = PQexecParams(layerinfo->conn, query_string_0_6,0, NULL, NULL, NULL, NULL, 0);
if(result && PQresultStatus(result) == PGRES_COMMAND_OK)
{
@@ -1317,7 +1317,7 @@
}
PQclear(query_result);
- query_result = PQexec(layerinfo->conn, query_str);
+ query_result = PQexecParams(layerinfo->conn, query_str,0, NULL, NULL, NULL, NULL, 0);
if(!query_result || PQresultStatus(query_result) != PGRES_COMMAND_OK) {
msSetError(MS_QUERYERR, "Error executing POSTGIS SQL statement (in FETCH ALL): %s\n-%s\nMore Help:", "msPOSTGISLayerGetShape()", query_str, PQerrorMessage(layerinfo->conn));
@@ -1526,7 +1526,7 @@
/* geom_column_name is needed later */
free(table_name);
- query_result = PQexec(layerinfo->conn, sql);
+ query_result = PQexecParams(layerinfo->conn, sql,0, NULL, NULL, NULL, NULL, 0);
if(!query_result || PQresultStatus(query_result) != PGRES_TUPLES_OK) {
msSetError(MS_QUERYERR, "Error executing POSTGIS SQL statement (in msPOSTGISLayerGetItems): %s\n-%s\n", "msPOSTGISLayerGetItems()", sql, PQerrorMessage(layerinfo->conn));
More information about the mapserver-commits
mailing list