feat(database): add support for variable inline

archguard · Mar 31, 2022 · bfe4922 · bfe4922
1 parent 4f66b14
commit bfe4922
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/scan_sourcecode/src/main/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyser.kt b/scan_sourcecode/src/main/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyser.kt
@@ -72,14 +72,14 @@ class MysqlAnalyser {
     fun sqlify(value: String): String {
         var text = handleRawString(value)
         text = removeBeginEndQuotes(text)
+        text = removeVariableInLine(text)
         text = removeNextLine(text)
         text = removePlus(text)
         text = processIn(text)
         return text
     }
 
     private val RAW_STRING_REGEX = "\"\"\"(((.*?)|\n)+)\"\"\"".toRegex()
-
     private fun handleRawString(text: String): String {
         val rawString = RAW_STRING_REGEX.find(text)
         if(rawString != null) {
@@ -89,8 +89,18 @@ class MysqlAnalyser {
         return text
     }
 
-    private val IN_REGEX = "in\\s+\\((\\s+)?<([a-zA-Z]+)>(\\s+)?\\)".toRegex()
+    // some text: "\"+orderSqlPiece+\""
+    private val VARIABLE_IN_LINE = "(\"\\\\\"\\+[a-zA-Z_]+\\+\"\\\\\")".toRegex()
+    private fun removeVariableInLine(text: String): String {
+        val find = VARIABLE_IN_LINE.find(text)
+        if (find != null) {
+            return text.replace(VARIABLE_IN_LINE, "*")
+        }
 
+        return text
+    }
+
+    private val IN_REGEX = "in\\s+\\((\\s+)?<([a-zA-Z]+)>(\\s+)?\\)".toRegex()
     private fun processIn(text: String): String {
         val find = IN_REGEX.find(text)
         if (find != null) {

diff --git a/...sourcecode/src/test/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyserTest.kt b/...sourcecode/src/test/kotlin/org/archguard/scanner/sourcecode/database/MysqlAnalyserTest.kt
@@ -28,6 +28,15 @@ internal class MysqlAnalyserTest {
         assertEquals(false, sqlify.contains("\"\"\""))
     }
 
+
+    @Test
+    fun should_handle_variable_in_sql() {
+        val sqlify =
+            MysqlAnalyser().sqlify("select id, module_name from \"\\\"+orderSqlPiece+\"\\\"\"")
+
+        assertEquals("select id, module_name from *", sqlify)
+    }
+
     @Test
     fun should_ident_jdbi_create_query_annotation() {
         val resource = this.javaClass.classLoader.getResource("jdbi/ContainerServiceDao.kt")!!