Hi,
in order to check for SQL-injection vulnerabilities in a legacy code
base, I've disabled string literals. However some of the code uses
connection.getMetaData().getColumns(...), which excepts. The error
seems to be in
org.h2.jdbc.JdbcDatabaseMetaData, line 231 and onwards, in which
getColumns is implemented by running a query that uses string
literals.
Sample code to reproduce:
public static void main( String ... args ) throws Exception {
Class.forName( "org.h2.Driver" );
Connection c = DriverManager.getConnection( "jdbc:h2:mem:unit-
test-memdb", "sa", null );
c.prepareStatement( "SET ALLOW_LITERALS NONE" ).execute();
DatabaseMetaData metaData = c.getMetaData();
ResultSet cols = metaData.getColumns(null, null, null, null);
}
which causes org.h2.jdbc.JdbcSQLException: Literals of this kind are
not allowed; on last line.
Is this a bug (or missing feature)? Is it possible to refactor the
code to use constants instead of string literals, or to avoid literal-
checking somehow? (I guess code originating from the driver should be
trusted...)
Workaround is of course to allow literals before executing this step,
then disable it afterwards, but that is rather tricky, especially
considering that this product is multi-database compatible.
Answers, workarounds etc welcome!
Regards,
Narve
--
You received this message because you are subscribed to the Google Groups "H2
Database" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/h2-database?hl=en.
