0xdeafbeef commented on issue #2603: URL: https://github.com/apache/datafusion-sqlparser-rs/issues/2603#issuecomment-6453467253
DataFusion's SQL unparser hits the decoded-value case that #2706 leaves out. The unparser (`datafusion-sql`, used by `plan_to_sql` and `Unparser::expr_to_sql`) [builds `Value::SingleQuotedString`](https://github.com/apache/datafusion/blob/02b7149b5faae0dd2f8b6a6dea3dba7cfe1c69e8/datafusion/sql/src/unparser/expr.rs#L1412-L1418) from the value of every `Utf8`, `LargeUtf8` and `Utf8View` literal. Those strings are decoded values, for example the value of a filter predicate. With `sqlparser` 0.63.0, which DataFusion `main` uses, and with #2706 at 46f776d8, `Value::SingleQuotedString(r"x\' OR true --".to_string())` displays as `'x\' OR true --'`. In PostgreSQL with `standard_conforming_strings = on` (the default), that literal ends at `'x\'`, and ` OR true --` runs as SQL. So an application that unparses a filter whose string value comes from a user and sends the SQL to PostgreSQL gets SQL injection, with or without #2706. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
