Ensembia/occweb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Treat DESCRIBE as a read

Browse Source 
DESCRIBE and DESC only show a table on MySQL/MariaDB. SQLite's PRAGMA
stays out of the read list because it can also change settings.
This commit is contained in:
Dillard Blom
2026-09-30 04:00:33 +02:00
parent f89ced651b
commit 9861313961
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/Service/SqlGuard.php
+6 -2
View File
@@ -32,8 +32,12 @@ class SqlGuard
'/\bINTO\s+(OUTFILE|DUMPFILE)\b/i' => 'INTO OUTFILE/DUMPFILE', '/\bINTO\s+(OUTFILE|DUMPFILE)\b/i' => 'INTO OUTFILE/DUMPFILE',
]; ];
/** Statements that start with one of these only read, unless WRITES_INSIDE_READ matches. */ /**
private const READ_ONLY_START = '/^(SELECT|WITH|SHOW|EXPLAIN|SET|VALUES|TABLE)\b/i'; * Statements that start with one of these only read, unless
* WRITES_INSIDE_READ matches. SQLite's PRAGMA is left out on purpose:
* it can also change settings, so it asks for confirmation.
*/
private const READ_ONLY_START = '/^(SELECT|WITH|SHOW|EXPLAIN|DESCRIBE|DESC|SET|VALUES|TABLE)\b/i';
/** /**
* What makes a statement that starts as a read change something: * What makes a statement that starts as a read change something:
tests/Unit/Service/SqlGuardTest.php
+3
View File
@@ -74,6 +74,8 @@ class SqlGuardTest extends TestCase
["SELECT \$\$DELETE FROM x\$\$"], ["SELECT \$\$DELETE FROM x\$\$"],
["SELECT E'it\\'s delete' FROM t"], ["SELECT E'it\\'s delete' FROM t"],
['VALUES (1)'], ['VALUES (1)'],
['DESCRIBE oc_users'],
['DESC oc_users'],
["SELECT '/* not a comment */' AS a, '-- nor this' AS b"], ["SELECT '/* not a comment */' AS a, '-- nor this' AS b"],
]; ];
} }
@@ -113,6 +115,7 @@ class SqlGuardTest extends TestCase
["SELECT nextval('seq')"], ["SELECT nextval('seq')"],
['MERGE INTO t USING s ON true WHEN MATCHED THEN DELETE'], ['MERGE INTO t USING s ON true WHEN MATCHED THEN DELETE'],
['VACUUM'], ['VACUUM'],
['PRAGMA journal_mode = WAL'],
["WITH a AS (SELECT '/*'), b AS (DELETE FROM t RETURNING 1) SELECT '*/'"], ["WITH a AS (SELECT '/*'), b AS (DELETE FROM t RETURNING 1) SELECT '*/'"],
["SELECT '--' AS x FROM t WHERE a IN (SELECT 1) FOR UPDATE"], ["SELECT '--' AS x FROM t WHERE a IN (SELECT 1) FOR UPDATE"],
["WITH a AS (SELECT \$\$/*\$\$), b AS (DELETE FROM t RETURNING 1) SELECT '*/'"], ["WITH a AS (SELECT \$\$/*\$\$), b AS (DELETE FROM t RETURNING 1) SELECT '*/'"],