feat(database): support for jdbi binding

archguard · Mar 31, 2022 · 4549046 · 4549046
1 parent efe8fc0
commit 4549046
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/scan_sourcecode/src/main/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyser.kt b/scan_sourcecode/src/main/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyser.kt
@@ -74,6 +74,7 @@ class MysqlAnalyser {
         text = removeBeginEndQuotes(text)
         text = removeVariableInLine(text)
         text = removeNextLine(text)
+        text = removeJdbiValueBind(text)
         text = removePlus(text)
         text = processIn(text)
         return text
@@ -82,7 +83,7 @@ class MysqlAnalyser {
     private val RAW_STRING_REGEX = "\"\"\"(((.*?)|\n)+)\"\"\"".toRegex()
     private fun handleRawString(text: String): String {
         val rawString = RAW_STRING_REGEX.find(text)
-        if(rawString != null) {
+        if (rawString != null) {
             return rawString.groups[1]!!.value
         }
 
@@ -110,6 +111,18 @@ class MysqlAnalyser {
         return text
     }
 
+
+    // example: `where system_id=:systemId ` => `where system_id=''`
+    private val JDBI_VALUE_BIND = ":([a-zA-Z_]+)".toRegex()
+    private fun removeJdbiValueBind(text: String): String {
+        val find = JDBI_VALUE_BIND.find(text)
+        if (find != null) {
+            return text.replace(JDBI_VALUE_BIND, "''")
+        }
+
+        return text
+    }
+
     private fun removeNextLine(text: String) = text.replace("\n", "")
     private fun removePlus(text: String) = text.replace("\"+\"", "")
     private fun removeBeginEndQuotes(value: String) = value.removeSuffix("\"").removePrefix("\"")

diff --git a/...sourcecode/src/test/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyserTest.kt b/...sourcecode/src/test/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyserTest.kt
@@ -28,7 +28,6 @@ internal class MysqlAnalyserTest {
         assertEquals(false, sqlify.contains("\"\"\""))
     }
 
-
     @Test
     fun should_handle_variable_in_sql() {
         val sqlify =
@@ -37,6 +36,13 @@ internal class MysqlAnalyserTest {
         assertEquals("select id, module_name from *", sqlify)
     }
 
+    @Test
+    fun should_handle_kotlin_string_in_sql() {
+        val sqlify = MysqlAnalyser().sqlify("\"select id, name, module, loc, access from code_class where system_id=:systemId and name=:name and module <=> :module\"")
+
+        assertEquals("select id, name, module, loc, access from code_class where system_id='' and name='' and module <=> ''", sqlify)
+    }
+
     @Test
     fun should_ident_jdbi_create_query_annotation() {
         val resource = this.javaClass.classLoader.getResource("jdbi/ContainerServiceDao.kt")!!