From ab1422ec161ac33c488f6d2aecccafb7b5aa5408 Mon Sep 17 00:00:00 2001
From: Fabrice Lecomte <fabrice.lecomte.be@gmail.com>
Date: Sun, 18 Jul 2021 02:22:08 +0200
Subject: [PATCH] Escape SQL argument for sendQuery

---
 .idea/runConfigurations/tests.xml             |  6 +++++
 .../fr/postgresjson/connexion/Connection.kt   | 26 +++++++++++++++++--
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/.idea/runConfigurations/tests.xml b/.idea/runConfigurations/tests.xml
index ceb308e..a2d3df1 100644
--- a/.idea/runConfigurations/tests.xml
+++ b/.idea/runConfigurations/tests.xml
@@ -2,6 +2,12 @@
   <configuration default="false" name="tests" type="JUnit" factoryName="JUnit" singleton="false">
     <module name="postgres-json.test" />
     <useClassPathOnly />
+    <extension name="coverage">
+      <pattern>
+        <option name="PATTERN" value="fr.postgresjson.*" />
+        <option name="ENABLED" value="true" />
+      </pattern>
+    </extension>
     <extension name="net.ashald.envfile">
       <option name="IS_ENABLED" value="false" />
       <option name="IS_SUBST" value="false" />
diff --git a/src/main/kotlin/fr/postgresjson/connexion/Connection.kt b/src/main/kotlin/fr/postgresjson/connexion/Connection.kt
index 9a3609d..2ea6760 100644
--- a/src/main/kotlin/fr/postgresjson/connexion/Connection.kt
+++ b/src/main/kotlin/fr/postgresjson/connexion/Connection.kt
@@ -14,8 +14,8 @@ import fr.postgresjson.entity.Serializable
 import fr.postgresjson.serializer.Serializer
 import fr.postgresjson.utils.LoggerDelegate
 import org.slf4j.Logger
-import java.lang.ClassCastException
 import java.util.concurrent.CompletableFuture
+import kotlin.random.Random
 
 typealias SelectOneCallback<T> = QueryResult.(T?) -> Unit
 typealias SelectCallback<T> = QueryResult.(List<T>) -> Unit
@@ -239,7 +239,7 @@ class Connection(
                 values[i] ?: queryError("Parameter $i missing", sql, values)
                 val valToReplace = values[i].toString()
                 ++i
-                "'$valToReplace'"
+                escapeParameter(valToReplace)
             }
 
             return block(newSql)
@@ -248,6 +248,28 @@ class Connection(
         return block(sql)
     }
 
+    /**
+     * Escape parameter by generate a random tag to prevent SQL injection
+     */
+    private fun escapeParameter(parameter: String): String {
+        val escapeTag = escapeTag().let {
+            if (parameter.indexOf(it) >= 0) escapeParameter(parameter) else it
+        }
+        return """$escapeTag$parameter$escapeTag"""
+    }
+
+    /**
+     * Generate a random alphaNum tag of 8 characters
+     */
+    private fun escapeTag(): String {
+        val charPool: List<Char> = ('a'..'z') + ('A'..'Z')
+        val tagName = (1..8)
+            .map { _ -> Random.nextInt(0, charPool.size) }
+            .map(charPool::get)
+            .joinToString("")
+        return "\$$tagName\$"
+    }
+
     data class ParametersQuery(val sql: String, val parameters: List<Any?>)
 
     private fun <T> stopwatchQuery(sql: String, values: List<Any?> = emptyList(), callback: () -> T): T {