noth/surrealpatch
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don’t allow use of $ param with no value in queries

Browse source 
Beforehand it was possible to do  SELECT * FROM $  which would show all of the variables defined. This is now not possible, and variables must be specified using their defined name.
This commit is contained in:
Tobie Morgan Hitchcock 2018-05-30 19:06:48 +01:00
parent 8ab01b510f
commit ddefed03e6
1 changed files with 20 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
db/fetch.go
View file

@ -106,6 +106,8 @@ func (e *executor) fetch(ctx context.Context, val interface{}, doc *data.Doc) (o
case *sql.Param: case *sql.Param:
if len(val.ID) > 0 {
for _, s := range paramSearchKeys { for _, s := range paramSearchKeys {
if obj, ok := ctx.Value(s).(*data.Doc); ok { if obj, ok := ctx.Value(s).(*data.Doc); ok {
@ -134,6 +136,8 @@ func (e *executor) fetch(ctx context.Context, val interface{}, doc *data.Doc) (o
} }
}
return nil, nil return nil, nil
case *sql.RunStatement: case *sql.RunStatement: