Commit graph

9 commits

Author SHA1 Message Date
Bartosz Dziewoński
9ae6fbda79 rdbms: Warn when given an assoc array but keys are ignored
In some cases ISQLPlatform::makeList() will accept an associative
array (with string keys), but ignore the keys completely. Provide a
warning when this happens, and improve type hints so that Phan warns
about it too.

(We only warn about string keys, and not about gaps in an array
with int keys, because they arise often due to using array_diff()
or array_unique(), and that would trigger too many warnings.)

In Expression we already type-hinted it as a list (int keys with no
gaps), and we're intentionally less flexible about some other cases,
so check for gaps too and throw an exception instead of a warning.

Change-Id: I63717d16eae7cccd929b5d232944b97989113b1e
2024-05-20 17:20:28 +00:00
Bartosz Dziewoński
e7c3381306 rdbms: Add more tests, and Phan tests, for expr() / Expression
I've been having fun documenting all the terrible array shapes
accepted by the various RDBMS methods with Phan type hints,
but I'm increasingly worried that either Phan will change how
it interprets them or that someone will break them by accident.

Add a test file, similar to the one we have for testing taint
annotations for Phan SecurityCheckPlugin, to guard against that.
Start filling it with some tests for expr() / Expression.

Add two missing test cases I noticed while writing these.

Change-Id: Icb54d5a7529f7f82ff5d130dcea0a22450155c10
2024-05-12 01:45:45 +02:00
James D. Forrester
2cc22d8811 ExpressionTest: List the other covered classes
They're listed as imports but not in the @covers list.

Change-Id: I0c78f676269121967bf3b478e4f42aeda9979507
2024-03-28 16:56:34 +00:00
Bartosz Dziewoński
fe3b56f1ce rdbms: Remove stray extra space from LIKE expressions
It doesn't do anything. It was added in ae57ab1eec (SVN r57989)
presumably by accident and carefully preserved through many
refactorings of this code.

Change-Id: Id2dfe3a379d8322e0dff81f7e009c3e44671b0de
2024-03-06 18:00:42 +01:00
Reedy
c14dd609a7 tests: Move Wikimedia tests into Wikimedia\Tests
Change-Id: I9c64a631b0b4e8e4fef8a72ee0f749d35f918052
2024-02-17 02:09:08 +00:00
Bartosz Dziewoński
d5d1f23419 rdbms: Add support for NOT LIKE in expression builder
Add unit tests for LIKE and NOT LIKE, reformat existing test cases.
Improve validity checks in Expression.

Bug: T210206
Change-Id: If7d860ad29247da5d8877e1265ce9307e7588018
2023-12-06 19:14:40 +01:00
Amir Sarabadani
76160d01e9 rdbms: Add a strict regex on $field on expression builder
This is another line of defense against SQL injection

Bug: T210206
Change-Id: I3c78faa18886e3ded7a04b0a396bcf24e076fa42
2023-11-22 12:47:26 +01:00
Tim Starling
9d9c782fb3 rdbms: In Expression, compare single element arrays as in makeList()
Database::makeList() in the LIST_AND mode has a special case for arrays
with a single element, with a plausible rationale. Extend this to
Expression so that we can do

  $db->expr( 'user_id', '=', [ 1 ] )

the expected result being (user_id = 1)

Change-Id: I430d28a884ff79efd53d346132f3d4a072fa85a6
2023-11-06 22:05:16 +00:00
Amir Sarabadani
3ef6662f31 rdbms: Introduce expression builder
To avoid accepting raw SQL in conditions and avoid the need to call to
addQuotes() which might get forgotten and open a SQL injection vulnerability.

A migration path would be something like the following:

Before:
'rev_timestamp > ' . $db->addQuotes( $timestamp )
After:
$db->expr( 'rev_timestamp', '>', $timestamp )

See the ticket for more information and reasoning.

Bug: T210206
Change-Id: I72431410c21ab97e797c7df07bf0dedd19307e65
2023-10-20 20:15:55 +00:00