@Test public void secureAggregateColumnsQuery() { String sql = new SqlSecurer("SELECT SUM(column1) FROM Table").getSecureSql(); Assert.assertEquals(sql, "SELECT SUM(\"column1\") FROM \"Table\""); }
public String getSecureSql() { sql = sql.replaceAll("(?i)(?!`)([\\s\\.]?)primary([\\s\\.?])(?!`)", "$1`primary`$2"); sql = sql.replaceAll("(?i)AS '(.*?)'", "AS \"$1\""); sql = sql.replaceAll("(?i)([\\s(])DATE\\((.*?)\\)", "$1TIMESTAMP($2)"); sql = sql.replaceAll("(?i)\\sFOR UPDATE", ""); sql = sql.replaceAll("(?i)\\s=\\sNULL", " IS NULL"); sql = sql.replaceAll("(?i)\\s!=\\sNULL", " IS NOT NULL"); sql = sql.replaceAll("(?i)\\s<>\\sNULL", " IS NOT NULL"); Select stmt = null; try { stmt = (Select) CCJSqlParserUtil.parse(sql); } catch (JSQLParserException e) { throw new RuntimeException(e); } stmt.getSelectBody().accept(new SqlSecurerVisitor()); return stmt.toString(); }
SqlSecurer { public String getSecureSql() { sql = sql.replaceAll("(?i)(?!`)([\\s\\.]?)primary([\\s\\.?])(?!`)", "$1`primary`$2"); sql = sql.replaceAll("(?i)AS '(.*?)'", "AS \"$1\""); sql = sql.replaceAll("(?i)([\\s(])DATE\\((.*?)\\)", "$1TIMESTAMP($2)"); sql = sql.replaceAll("(?i)\\sFOR UPDATE", ""); sql = sql.replaceAll("(?i)\\s=\\sNULL", " IS NULL"); sql = sql.replaceAll("(?i)\\s!=\\sNULL", " IS NOT NULL"); sql = sql.replaceAll("(?i)\\s<>\\sNULL", " IS NOT NULL"); Select stmt = null; try { stmt = (Select) CCJSqlParserUtil.parse(sql); } catch (JSQLParserException e) { throw new RuntimeException(e); } stmt.getSelectBody().accept(new SqlSecurerVisitor()); return stmt.toString(); } }
SqlSecurer { public String getSecureSql() { sql = sql.replaceAll("(?i)(?!`)([\\s\\.]?)primary([\\s\\.?])(?!`)", "$1`primary`$2"); sql = sql.replaceAll("(?i)AS '(.*?)'", "AS \"$1\""); sql = sql.replaceAll("(?i)([\\s(])DATE\\((.*?)\\)", "$1TIMESTAMP($2)"); sql = sql.replaceAll("(?i)\\sFOR UPDATE", ""); sql = sql.replaceAll("(?i)\\s=\\sNULL", " IS NULL"); sql = sql.replaceAll("(?i)\\s!=\\sNULL", " IS NOT NULL"); sql = sql.replaceAll("(?i)\\s<>\\sNULL", " IS NOT NULL"); Select stmt = null; try { stmt = (Select) CCJSqlParserUtil.parse(sql); } catch (JSQLParserException e) { throw new RuntimeException(e); } stmt.getSelectBody().accept(new SqlSecurerVisitor()); return stmt.toString(); } SqlSecurer(String sql); }
SqlSecurer { public String getSecureSql() { sql = sql.replaceAll("(?i)(?!`)([\\s\\.]?)primary([\\s\\.?])(?!`)", "$1`primary`$2"); sql = sql.replaceAll("(?i)AS '(.*?)'", "AS \"$1\""); sql = sql.replaceAll("(?i)([\\s(])DATE\\((.*?)\\)", "$1TIMESTAMP($2)"); sql = sql.replaceAll("(?i)\\sFOR UPDATE", ""); sql = sql.replaceAll("(?i)\\s=\\sNULL", " IS NULL"); sql = sql.replaceAll("(?i)\\s!=\\sNULL", " IS NOT NULL"); sql = sql.replaceAll("(?i)\\s<>\\sNULL", " IS NOT NULL"); Select stmt = null; try { stmt = (Select) CCJSqlParserUtil.parse(sql); } catch (JSQLParserException e) { throw new RuntimeException(e); } stmt.getSelectBody().accept(new SqlSecurerVisitor()); return stmt.toString(); } SqlSecurer(String sql); String getSecureSql(); }
SqlSecurer { public String getSecureSql() { sql = sql.replaceAll("(?i)(?!`)([\\s\\.]?)primary([\\s\\.?])(?!`)", "$1`primary`$2"); sql = sql.replaceAll("(?i)AS '(.*?)'", "AS \"$1\""); sql = sql.replaceAll("(?i)([\\s(])DATE\\((.*?)\\)", "$1TIMESTAMP($2)"); sql = sql.replaceAll("(?i)\\sFOR UPDATE", ""); sql = sql.replaceAll("(?i)\\s=\\sNULL", " IS NULL"); sql = sql.replaceAll("(?i)\\s!=\\sNULL", " IS NOT NULL"); sql = sql.replaceAll("(?i)\\s<>\\sNULL", " IS NOT NULL"); Select stmt = null; try { stmt = (Select) CCJSqlParserUtil.parse(sql); } catch (JSQLParserException e) { throw new RuntimeException(e); } stmt.getSelectBody().accept(new SqlSecurerVisitor()); return stmt.toString(); } SqlSecurer(String sql); String getSecureSql();  }