db25fbf · squeal · git.iko.soy

git.iko.soy/squeal

on dev help sign in

insert & inject

db25fbfEitan Chatav10 years ago

squeel-postgresql/src/Squeel/PostgreSQL/PQ.hs+8−3

compare with dev

unifiedsplit

@@ -24,6 +24,7 @@ import Data.Proxy

24import Data.Text (Text)

25import Data.Vinyl

26import Data.Vinyl.Functor

27+import GHC.TypeLits

28import qualified Database.PostgreSQL.LibPQ as LibPQ

29import qualified Database.PostgreSQL.LibPQ as LibPQ

@@ -33,9 +34,13 @@ import Squeel.PostgreSQL.Type

34newtype Connection db = Connection { unConnection :: LibPQ.Connection }

35newtype Connection db = Connection { unConnection :: LibPQ.Connection }

36−newtype PQ db0 db1 m x = PQ

37+newtype PQ

38+ (db0 :: [(Symbol,[(Symbol,PGType)])])

39+ (db1 :: [(Symbol,[(Symbol,PGType)])])

40+ (m :: * -> *)

41+ (x :: *) =

37− { runPQ :: Connection db0 -> m (x, Connection db1) }

42+ PQ { runPQ :: Connection db0 -> m (x, Connection db1) }

38− deriving Functor

43+ deriving Functor

40evalPQ :: Functor m => PQ db0 db1 m x -> Connection db0 -> m x

45evalPQ :: Functor m => PQ db0 db1 m x -> Connection db0 -> m x

41evalPQ (PQ pq) = fmap fst . pq

46evalPQ (PQ pq) = fmap fst . pq

squeel-postgresql/src/Squeel/PostgreSQL/Query.hs+27−23

@@ -96,8 +96,11 @@ instance (KnownSymbol label, AllAliased (x' ': xs))

96 (x :& xs :: Rec (Aliased obj) ('(label, x) ': x' : xs)) =

97 renderAliased render x <> ", " <> renderAllAliased render xs

99−newtype Expression ps (xs :: [(Symbol,PGType)]) y =

99+newtype Expression

100+ (ps :: [PGType])

101+ (xs :: [(Symbol,PGType)])

102+ (y :: PGType) =

100− UnsafeExpression { renderExpression :: ByteString }

103+ UnsafeExpression { renderExpression :: ByteString }

101

104

102param1 :: Expression (p1:ps) cols p1

105param1 :: Expression (p1:ps) cols p1

103param1 = UnsafeExpression "$1"

106param1 = UnsafeExpression "$1"

@@ -170,8 +173,11 @@ instance OrdB (Expression ps xs y) where

170 x <* y = UnsafeExpression $ renderExpression x <> "<" <> renderExpression y

173 x <* y = UnsafeExpression $ renderExpression x <> "<" <> renderExpression y

171 x <=* y = UnsafeExpression $ renderExpression x <> "<=" <> renderExpression y

174 x <=* y = UnsafeExpression $ renderExpression x <> "<=" <> renderExpression y

172

175

173−newtype Projection ps xs ys = UnsafeProjection

176+newtype Projection

177+ (ps :: [PGType])

178+ (xs :: [(Symbol,PGType)])

179+ (ys :: [(Symbol,PGType)]) =

174− { renderProjection :: ByteString }

180+ UnsafeProjection { renderProjection :: ByteString }

175

181

176star :: Projection ps xs xs

182star :: Projection ps xs xs

177star = UnsafeProjection "*"

183star = UnsafeProjection "*"

@@ -254,33 +260,31 @@ subselect selection = Relation

254 , offsetting = Nothing

260 , offsetting = Nothing

255 }

261 }

256

262

257−newtype Insertion ps xss xs = UnsafeInsertion

263+newtype Query

258− {renderInsertion :: ByteString }

264+ (ps :: [PGType])

265+ (xss :: [(Symbol,[(Symbol,PGType)])])

266+ (yss :: [(Symbol,[(Symbol,PGType)])])

267+ (zs :: [(Symbol,PGType)]) =

268+ UnsafeQuery { renderQuery :: ByteString }

269+newtype PreparedQuery ps xss yss zs =

270+ UnsafePreparedQuery { renderPreparedQuery :: ByteString }

259

271

260−into

272+select :: Selection ps xss ys -> Query ps xss xss ys

273+select selection = UnsafeQuery $

274+ "SELECT " <> renderSelection selection <> ";"

275+

276+insertInto

261− :: forall label xss xs ps

277+ :: forall xss xs label ps

262 . (HasField label xss xs, UnzipAliased xs)

278 . (HasField label xss xs, UnzipAliased xs)

263 => Proxy label

279 => Proxy label

264 -> Rec (Aliased (Expression ps '[])) xs

280 -> Rec (Aliased (Expression ps '[])) xs

265− -> Insertion ps xss xs

281+ -> Query ps xss xss '[]

266−into table values = UnsafeInsertion $ "INTO "

282+insertInto table values = UnsafeQuery $ "INSERT INTO "

267 <> fieldName table (Proxy @xss) (Proxy @xs)

283 <> fieldName table (Proxy @xss) (Proxy @xs)

268 <> " (" <> ByteString.intercalate ", " names

284 <> " (" <> ByteString.intercalate ", " names

269 <> ") VALUES ("

285 <> ") VALUES ("

270 <> ByteString.intercalate ", "

286 <> ByteString.intercalate ", "

271 (recordToList (rmap (Const . renderExpression) exprs))

287 (recordToList (rmap (Const . renderExpression) exprs))

272− <> ")"

288+ <> ");"

273 where

289 where

274 (names,exprs) = unzipAliased values

290 (names,exprs) = unzipAliased values

275−

276−newtype Query ps xss yss zs = UnsafeQuery { renderQuery :: ByteString }

277−newtype PreparedQuery ps xss yss zs =

278− UnsafePreparedQuery { renderPreparedQuery :: ByteString }

279−

280−select :: Selection ps xss ys -> Query ps xss xss ys

281−select selection = UnsafeQuery $

282− "SELECT " <> renderSelection selection <> ";"

283−

284−insert :: Insertion ps xss xs -> Query ps xss xss '[]

285−insert insertion = UnsafeQuery $

286− "INSERT " <> renderInsertion insertion <> ";"

squeel-postgresql/test/Squeel/PostgreSQL/QuerySpec.hs+10−4

@@ -50,9 +50,15 @@ spec = do

50 `shouldBe`

51 "SELECT * FROM table1 OFFSET 1+2;"

52 it "correctly render simple INSERTs" $ do

53− renderQuery (insert insertion)

53+ renderQuery (insertInto @Tables @Columns (Proxy @"table1")

54+ ((2 `As` #col1 :& 4 `As` #col2 :& RNil)))

54 `shouldBe`

55 `shouldBe`

55 "INSERT INTO table1 (col1, col2) VALUES (2, 4);"

56 "INSERT INTO table1 (col1, col2) VALUES (2, 4);"

57+ it "should be safe against SQL injection in literal text" $ do

58+ pendingWith "gotta find an escape function"

59+ -- renderQuery (select (literalText `from` table1))

60+ -- `shouldBe`

61+ -- "SELECT '\\'DROP TABLE table1;' AS literal FROM table1;"

57type Columns = '[ '("col1", 'PGInt4), '("col2", 'PGInt4)]

63type Columns = '[ '("col1", 'PGInt4), '("col2", 'PGInt4)]

58type Tables = '[ '("table1", Columns)]

64type Tables = '[ '("table1", Columns)]

@@ -60,11 +66,11 @@ type Tables = '[ '("table1", Columns)]

60sumAndCol1 :: Projection '[] Columns '[ '("sum", 'PGInt4), '("col1", 'PGInt4)]

66sumAndCol1 :: Projection '[] Columns '[ '("sum", 'PGInt4), '("col1", 'PGInt4)]

61sumAndCol1 = project ((#col1 + #col2) `As` #sum :& #col1 :& RNil)

67sumAndCol1 = project ((#col1 + #col2) `As` #sum :& #col1 :& RNil)

69+literalText :: Projection '[] Columns '[ '("literal", 'PGText)]

70+literalText = project ("\';DROP TABLE table1;" `As` #literal :& RNil)

71+

63table1 :: Relation '[] Tables Columns

72table1 :: Relation '[] Tables Columns

64table1 = #table1

73table1 = #table1

66parameterizedTable1 :: Relation '[ 'PGInt8] Tables Columns

75parameterizedTable1 :: Relation '[ 'PGInt8] Tables Columns

67parameterizedTable1 = #table1

76parameterizedTable1 = #table1

68−

69−insertion :: Insertion '[] Tables Columns

70−insertion = into (Proxy @"table1") (2 `As` #col1 :& 4 `As` #col2 :& RNil)