Fix potential for injection attack

Yuck · Mar 7, 2023 · cd307d3 · cd307d3
1 parent 486e0dc
commit cd307d3
Show file tree

Hide file tree

Showing 14 changed files with 40 additions and 22 deletions.
diff --git a/src/YuckQi.Data.DocumentDb.MongoDb/YuckQi.Data.DocumentDb.MongoDb.csproj b/src/YuckQi.Data.DocumentDb.MongoDb/YuckQi.Data.DocumentDb.MongoDb.csproj
@@ -6,7 +6,7 @@
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <Authors>Kevin J Lambert</Authors>
     <Product>YuckQi.Data</Product>
-    <Version>6.2.0</Version>
+    <Version>6.2.1</Version>
     <Description>An implementation of YuckQi.Data for MongoDB databases.</Description>
     <RepositoryUrl>https://github.com/Yuck/YuckQi.Data.git</RepositoryUrl>
     <RepositoryType>git</RepositoryType>

diff --git a/src/YuckQi.Data.Sql.Dapper.MySql/SqlGenerator.cs b/src/YuckQi.Data.Sql.Dapper.MySql/SqlGenerator.cs
@@ -115,7 +115,7 @@ private static String BuildWhereSql(IEnumerable<FilterCriteria>? parameters)
             var value = t.Value;
             var comparison = BuildComparison(value, t.Operation);
             var set = t.Value is IEnumerable enumerable
-                          ? (from Object? item in enumerable select item is String stringItem ? $"'{stringItem}'" : $"{item}").ToList()
+                          ? enumerable.Cast<Object>().ToArray().Select((_, i) => $"@{t.FieldName}{i}").ToList()
                           : null;
             var parameter = t.Operation == FilterOperation.In
                                 ? set != null && set.Any()

diff --git a/src/YuckQi.Data.Sql.Dapper.MySql/YuckQi.Data.Sql.Dapper.MySql.csproj b/src/YuckQi.Data.Sql.Dapper.MySql/YuckQi.Data.Sql.Dapper.MySql.csproj
@@ -5,7 +5,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <Authors>Kevin J Lambert</Authors>
-    <Version>6.2.0</Version>
+    <Version>6.2.1</Version>
     <Description>An implementation of YuckQi.Data for MySQL databases using Dapper and SimpleCRUD.</Description>
     <Product>YuckQi.Data</Product>
     <RepositoryUrl>https://github.com/Yuck/YuckQi.Data.git</RepositoryUrl>

diff --git a/src/YuckQi.Data.Sql.Dapper.Oracle/SqlGenerator.cs b/src/YuckQi.Data.Sql.Dapper.Oracle/SqlGenerator.cs
@@ -115,7 +115,7 @@ private static String BuildWhereSql(IEnumerable<FilterCriteria>? parameters)
             var value = t.Value;
             var comparison = BuildComparison(value, t.Operation);
             var set = t.Value is IEnumerable enumerable
-                          ? (from Object? item in enumerable select item is String stringItem ? $"'{stringItem}'" : $"{item}").ToList()
+                          ? enumerable.Cast<Object>().ToArray().Select((_, i) => $":{t.FieldName}{i}").ToList()
                           : null;
             var parameter = t.Operation == FilterOperation.In
                                 ? set != null && set.Any()

diff --git a/src/YuckQi.Data.Sql.Dapper.Oracle/YuckQi.Data.Sql.Dapper.Oracle.csproj b/src/YuckQi.Data.Sql.Dapper.Oracle/YuckQi.Data.Sql.Dapper.Oracle.csproj
@@ -5,7 +5,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Description>An implementation of YuckQi.Data for Oracle databases using Dapper and SimpleCRUD.</Description>
     <Authors>Kevin J Lambert</Authors>
-    <Version>6.2.0</Version>
+    <Version>6.2.1</Version>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <Product>YuckQi.Data</Product>
     <RepositoryUrl>https://github.com/Yuck/YuckQi.Data.git</RepositoryUrl>

diff --git a/src/YuckQi.Data.Sql.Dapper.SqlServer/SqlGenerator.cs b/src/YuckQi.Data.Sql.Dapper.SqlServer/SqlGenerator.cs
@@ -116,7 +116,7 @@ private static String BuildWhereSql(IEnumerable<FilterCriteria>? parameters)
             var value = t.Value;
             var comparison = BuildComparison(value, t.Operation);
             var set = t.Value is IEnumerable enumerable
-                          ? (from Object? item in enumerable select item is String stringItem ? $"'{stringItem}'" : $"{item}").ToList()
+                          ? enumerable.Cast<Object>().ToArray().Select((_, i) => $"@{t.FieldName}{i}").ToList()
                           : null;
             var parameter = t.Operation == FilterOperation.In
                                 ? set != null && set.Any()

diff --git a/src/YuckQi.Data.Sql.Dapper.SqlServer/YuckQi.Data.Sql.Dapper.SqlServer.csproj b/src/YuckQi.Data.Sql.Dapper.SqlServer/YuckQi.Data.Sql.Dapper.SqlServer.csproj
@@ -5,7 +5,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <Authors>Kevin J Lambert</Authors>
-    <Version>6.2.0</Version>
+    <Version>6.2.1</Version>
     <Description>An implementation of YuckQi.Data for MSSQL databases using Dapper and SimpleCRUD.</Description>
     <Product>YuckQi.Data</Product>
     <RepositoryUrl>https://github.com/Yuck/YuckQi.Data.git</RepositoryUrl>

diff --git a/src/YuckQi.Data.Sql.Dapper/Extensions/DynamicParameterExtensions.cs b/src/YuckQi.Data.Sql.Dapper/Extensions/DynamicParameterExtensions.cs
@@ -1,4 +1,5 @@
-using System.Data;
+using System.Collections;
+using System.Data;
 using Dapper;
 using YuckQi.Data.Filtering;
 
@@ -14,14 +15,31 @@ public static DynamicParameters ToDynamicParameters(this IEnumerable<FilterCrite
             return result;
 
         foreach (var parameter in parameters)
-        {
-            var name = parameter.FieldName;
-            var value = parameter.Value;
-            var type = value?.GetType();
-            var dbType = dbTypeMap != null && type != null && dbTypeMap.TryGetValue(type, out var mapped) ? (DbType?) mapped : null;
-
-            result.Add(name, value, dbType);
-        }
+            if (parameter.Operation == FilterOperation.In)
+            {
+                var set = parameter.Value is IEnumerable enumerable
+                              ? enumerable.Cast<Object>().ToArray()
+                              : throw new ArgumentException($"{nameof(parameter.Value)} must be convertible to {nameof(IEnumerable)}.");
+
+                for (var i = 0; i <= set.Length; i++)
+                {
+                    var name = $"{parameter.FieldName}{i}";
+                    var value = set[i];
+                    var type = value?.GetType();
+                    var dbType = dbTypeMap != null && type != null && dbTypeMap.TryGetValue(type, out var mapped) ? (DbType?) mapped : null;
+
+                    result.Add(name, value, dbType);
+                }
+            }
+            else
+            {
+                var name = parameter.FieldName;
+                var value = parameter.Value;
+                var type = value?.GetType();
+                var dbType = dbTypeMap != null && type != null && dbTypeMap.TryGetValue(type, out var mapped) ? (DbType?) mapped : null;
+
+                result.Add(name, value, dbType);
+            }
 
         return result;
     }

diff --git a/src/YuckQi.Data.Sql.Dapper/YuckQi.Data.Sql.Dapper.csproj b/src/YuckQi.Data.Sql.Dapper/YuckQi.Data.Sql.Dapper.csproj
@@ -5,7 +5,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <Authors>Kevin J Lambert</Authors>
-    <Version>6.2.0</Version>
+    <Version>6.2.1</Version>
     <Description>An implementation of YuckQi.Data for SQL databases using Dapper and SimpleCRUD.</Description>
     <Product>YuckQi.Data</Product>
     <RepositoryUrl>https://github.com/Yuck/YuckQi.Data.git</RepositoryUrl>

diff --git a/src/YuckQi.Data.Sql.EntityFramework/YuckQi.Data.Sql.EntityFramework.csproj b/src/YuckQi.Data.Sql.EntityFramework/YuckQi.Data.Sql.EntityFramework.csproj
@@ -5,7 +5,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <Authors>Kevin J Lambert</Authors>
-    <Version>6.2.0</Version>
+    <Version>6.2.1</Version>
     <Description>An implementation of YuckQi.Data for SQL databases using Entity Framework.</Description>
     <Product>YuckQi.Data</Product>
     <RepositoryUrl>https://github.com/Yuck/YuckQi.Data.git</RepositoryUrl>

diff --git a/src/YuckQi.Data/YuckQi.Data.csproj b/src/YuckQi.Data/YuckQi.Data.csproj
@@ -5,7 +5,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <Authors>Kevin J Lambert</Authors>
-    <Version>6.2.0</Version>
+    <Version>6.2.1</Version>
     <Description>A .NET library of lightweight data access handlers which can be used to compose repositories and domain services.</Description>
     <RepositoryUrl>https://github.com/Yuck/YuckQi.Data.git</RepositoryUrl>
     <RepositoryType>git</RepositoryType>

diff --git a/test/YuckQi.Data.Sql.Dapper.MySql.UnitTests/SqlGeneratorTests.cs b/test/YuckQi.Data.Sql.Dapper.MySql.UnitTests/SqlGeneratorTests.cs
@@ -130,7 +130,7 @@ public void GenerateGetQuery_WithInOperation_IsValid()
         var parameters = new[] { new FilterCriteria("Name", FilterOperation.In, new[] { "Bill", "Billy", "Mac", "Buddy" }) };
         var sql = generator.GenerateGetQuery(parameters).Replace(Environment.NewLine, " ");
 
-        Assert.That(sql, Is.EqualTo("select `Id`, `Name` from `SurLaTable` where (`Name` in ('Bill','Billy','Mac','Buddy'));"));
+        Assert.That(sql, Is.EqualTo("select `Id`, `Name` from `SurLaTable` where (`Name` in (@Name0,@Name1,@Name2,@Name3));"));
     }
 
     [Test]

diff --git a/test/YuckQi.Data.Sql.Dapper.Oracle.UnitTests/SqlGeneratorTests.cs b/test/YuckQi.Data.Sql.Dapper.Oracle.UnitTests/SqlGeneratorTests.cs
@@ -130,7 +130,7 @@ public void GenerateGetQuery_WithInOperation_IsValid()
         var parameters = new[] { new FilterCriteria("Name", FilterOperation.In, new[] { "Bill", "Billy", "Mac", "Buddy" }) };
         var sql = generator.GenerateGetQuery(parameters).Replace(Environment.NewLine, " ");
 
-        Assert.That(sql, Is.EqualTo("select \"Id\", \"Name\" from \"SurLaTable\" where (\"Name\" in ('Bill','Billy','Mac','Buddy'));"));
+        Assert.That(sql, Is.EqualTo("select \"Id\", \"Name\" from \"SurLaTable\" where (\"Name\" in (:Name0,:Name1,:Name2,:Name3));"));
     }
 
     [Test]

diff --git a/test/YuckQi.Data.Sql.Dapper.SqlServer.UnitTests/SqlGeneratorTests.cs b/test/YuckQi.Data.Sql.Dapper.SqlServer.UnitTests/SqlGeneratorTests.cs
@@ -130,7 +130,7 @@ public void GenerateGetQuery_WithInOperation_IsValid()
         var parameters = new[] { new FilterCriteria("Name", FilterOperation.In, new[] { "Bill", "Billy", "Mac", "Buddy" }) };
         var sql = generator.GenerateGetQuery(parameters).Replace(Environment.NewLine, " ");
 
-        Assert.That(sql, Is.EqualTo("select [Id], [Name] from [dbo].[SurLaTable] where ([Name] in ('Bill','Billy','Mac','Buddy'));"));
+        Assert.That(sql, Is.EqualTo("select [Id], [Name] from [dbo].[SurLaTable] where ([Name] in (@Name0,@Name1,@Name2,@Name3));"));
     }
 
     [Test]