Also unquote a function name followed by a comment

SELECT "pg_read_file" /* x */ ('/etc/passwd') still passed: the check for a following parenthesis only skipped whitespace. Skip comments too.
2026-09-30 17:45:09 +02:00
parent 839572f1fb
commit 93221b2905
2 changed files with 4 additions and 1 deletions
@@ -124,7 +124,7 @@ class SqlGuard
            $end = self::literalEnd($sql, $i);
            if ($end !== null) {
                $literal = substr($sql, $i, $end - $i);
-                if (preg_match('/^"([A-Za-z_][A-Za-z0-9_$]*)"$/', $literal, $m) && preg_match('/\G\s*\(/', $sql, $unused, 0, $end)) {
+                if (preg_match('/^"([A-Za-z_][A-Za-z0-9_$]*)"$/', $literal, $m) && preg_match('/\G(?:\s|--[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*\(/', $sql, $unused, 0, $end)) {
                    // A quoted function name ("setval"(...)) calls the same
                    // function as the bare word, so check it as one
                    $result .= $m[1];