Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

getUnquotedStatementFragments breaks on ESCAPE '\' #3640

Closed
rullzer opened this issue Aug 2, 2019 · 3 comments
Closed

getUnquotedStatementFragments breaks on ESCAPE '\' #3640

rullzer opened this issue Aug 2, 2019 · 3 comments

Comments

@rullzer
Copy link
Contributor

rullzer commented Aug 2, 2019

I encountered an issue where not all the parameters would be replaced correctly.

The query in question is:

SELECT "f".*
FROM "oc_filecache" "f" 
WHERE 
(
  (
    ("f"."storage" = :dcValue1) AND ("f"."path" LIKE :dcValue2 ESCAPE '\')
  ) OR (
    ("f"."storage" = :dcValue3) AND ("f"."path" LIKE :dcValue4 ESCAPE '\')
  ) OR (
    "f"."storage" = :dcValue5
  )
) AND (
  ("f"."mimetype" <> :dcValue6) OR ("f"."size" = 0)
) AND (
  "f"."path" NOT LIKE :dcValue7
) AND (
  "f"."path" NOT LIKE :dcValue8
)
ORDER BY "f"."mtime"
DESC LIMIT 500

Manually replacing all the values runs this like a charm.
However it seems the split in getUnquotedStatementFragments doesn't like ESCAPING on \.

What happens is that :dcValue1 and :dcValue2 are properly found.
However then the regex interpets the \' as an escaped quote. Thus ignoring until the next escape statement.

The replaces statement thus looks like

SELECT "f".*
FROM "oc_filecache" "f"
WHERE 
(
  (
    ("f"."storage" = ?) AND ("f"."path" LIKE ? ESCAPE "\")
  ) OR (
    ("f"."storage" = :dcValue3) AND ("f"."path" LIKE :dcValue4 ESCAPE "\")
  ) OR (
    "f"."storage" = :dcValue5
  )
) AND (
  ("f"."mimetype" <> :dcValue6) OR ("f"."size" = 0)
) AND (
  "f"."path" NOT LIKE :dcValue7
) AND (
  "f"."path" NOT LIKE :dcValue8
)
ORDER BY "f"."mtime"
DESC LIMIT 500

I'll try to dig a bit deeper or to come up with a PR that at least provides you with failing test cases to verify.

rullzer added a commit to rullzer/dbal that referenced this issue Aug 2, 2019
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
rullzer added a commit to rullzer/dbal that referenced this issue Aug 2, 2019
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
@SenseException
Copy link
Member

Thank you for reporting this issue and creating the test case 👍

morozov pushed a commit to morozov/dbal that referenced this issue Jan 22, 2020
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
@morozov
Copy link
Member

morozov commented Oct 30, 2021

This must have been fixed by #4397, no longer reproducible on 3.1.x. In the ANSI mode, the query in question is parsed as:

SELECT "f".*
FROM "oc_filecache" "f" 
WHERE 
(
  (
    ("f"."storage" = {:dcValue1}) AND ("f"."path" LIKE {:dcValue2} ESCAPE '\')
  ) OR (
    ("f"."storage" = {:dcValue3}) AND ("f"."path" LIKE {:dcValue4} ESCAPE '\')
  ) OR (
    "f"."storage" = {:dcValue5}
  )
) AND (
  ("f"."mimetype" <> {:dcValue6}) OR ("f"."size" = 0)
) AND (
  "f"."path" NOT LIKE {:dcValue7}
) AND (
  "f"."path" NOT LIKE {:dcValue8}
)
ORDER BY "f"."mtime"
DESC LIMIT 500

The curly braces identify what has been recognized as a parameter (see Doctrine\DBAL\Tests\SQL\ParserTest#testAnsiEscaping()).

@github-actions
Copy link

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jul 24, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

3 participants