This adds a phan plugin which checks for SQL injections on code using our QueryBuilder, while it isn't perfect it should already catch most potential issues.
As always, static analysis will sometimes have false positives and this is also here the case. So in some cases the analyzer just doesn't know if something is potential user input or not, thus I had to add some `@suppress SqlInjectionChecker` in front of those potential injections.
The Phan plugin hasn't the most awesome code but it works and I also added a file with test cases.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
Fixme:
- Install and update of apps
- No revert on live systems (debug only)
- Service adjustment to our interface
- Loading via autoloader
Signed-off-by: Joas Schilling <coding@schilljs.com>
* success on SQLite and Postgres
* failure on MySQL due to the limited charset that only supports up to 3 bytes
Add config option to update charset of mysql to utf8mb4
* fully optional
* requires additional options set in the database
only disable unicode test on mysql
Fixing ctor call
Adding docker based unit test execution for mysql utf8mb4
Add mysqlmb4 test configuration to Jenkinsfile
fix collation on utf8mb4
Properly setup charset and collation in the doctrine connection
Allow files containing 4-byte chars in case the database supports it
During setup of a mysql database we try to detect if charset 'utf8mb4' can be used
Fix mysql settings
Add console command to migrate the charset
Set ROW_FORMAT before setting collation to mb4
Also select tables with wrong collation
Faster MySQL docker
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Fixed failing test which was ignoring a required (not null) column
* restored test to original, catching DriverException which also catches ConstraintViolationException
* catch ConstraintViolationException again
* removed unnecessary field from this test
* clobfield should be nullable
* clobfield now is nullable
* removed autoincrement since whenever this strategy is enabled, oracle would not throw constraint violation exceptions (needed for setValues), which mysql still does
* this field does not auto increment anymore
* mark integerfield as primary, since it is not getting marked as such through auto increment anymore,
integerfield default always has been 0 instead of null
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
Lukas Reschke
Joas Schilling
Piotr Mrówczyński
Morris Jobke
Philipp Schaffrath
Roeland Jago Douma
Robin Appelman
Lukas Reschke
Joas Schilling
Roeland Jago Douma