dbe998fb4fcbff1af818ccff6c970b54def2648a galt Tue Jun 18 11:46:13 2013 -0700 found sql code that needed protection against sql injection diff --git src/hg/lib/annoStreamDb.c src/hg/lib/annoStreamDb.c index da358ce..cef93b4 100644 --- src/hg/lib/annoStreamDb.c +++ src/hg/lib/annoStreamDb.c @@ -123,46 +123,46 @@ if (minChrom && differentString(minChrom, streamer->chrom)) errAbort("annoStreamDb %s: nextRow minChrom='%s' but region chrom='%s'", streamer->name, minChrom, streamer->chrom); if (self->hasBin) { // Results will be in bin order, but we can restore chromStart order by // accumulating initial coarse-bin items and merge-sorting them with // subsequent finest-bin items which will be in chromStart order. resetMergeState(self); self->mergeBins = TRUE; self->qLm = lmInit(0); } if (self->endFieldIndexName != NULL) // Don't let mysql use a (chrom, chromEnd) index because that messes up // sorting by chromStart. - dyStringPrintf(query, " IGNORE INDEX (%s)", self->endFieldIndexName); - dyStringPrintf(query, " where %s='%s'", self->chromField, streamer->chrom); + sqlDyStringPrintf(query, " IGNORE INDEX (%s)", self->endFieldIndexName); + sqlDyStringPrintf(query, " where %s='%s'", self->chromField, streamer->chrom); int chromSize = annoAssemblySeqSize(streamer->assembly, streamer->chrom); if (streamer->regionStart != 0 || streamer->regionEnd != chromSize) { dyStringAppend(query, " and "); if (self->hasBin) hAddBinToQuery(streamer->regionStart, streamer->regionEnd, query); - dyStringPrintf(query, "%s < %u and %s > %u", self->startField, streamer->regionEnd, + sqlDyStringPrintf(query, "%s < %u and %s > %u", self->startField, streamer->regionEnd, self->endField, streamer->regionStart); } if (self->notSorted) - dyStringPrintf(query, " order by %s", self->startField); + sqlDyStringPrintf(query, " order by %s", self->startField); } else if (self->notSorted) - dyStringPrintf(query, " order by %s,%s", self->chromField, self->startField); + sqlDyStringPrintf(query, " order by %s,%s", self->chromField, self->startField); if (self->maxOutRows > 0) dyStringPrintf(query, " limit %d", self->maxOutRows); struct sqlResult *sr = sqlGetResult(self->conn, query->string); dyStringFree(&query); self->sr = sr; } static void rowBufInit(struct rowBuf *rowBuf, int size) /* Clean up rowBuf and give it a new lm and buffer[size]. */ { resetRowBuf(rowBuf); rowBuf->lm = lmInit(0); rowBuf->size = size; lmAllocArray(rowBuf->lm, rowBuf->buf, size); } @@ -253,55 +253,55 @@ queryMaxItems = self->maxOutRows; if (self->hasBin) { // Results will be in bin order, but we can restore chromStart order by // accumulating initial coarse-bin items and merge-sorting them with // subsequent finest-bin items which will be in chromStart order. if (self->doNextChunk && self->mergeBins && !self->gotFinestBin) errAbort("annoStreamDb can't continue merge in chunking query; increase ASD_CHUNK_SIZE"); self->mergeBins = TRUE; if (self->qLm == NULL) self->qLm = lmInit(0); } if (self->endFieldIndexName != NULL) // Don't let mysql use a (chrom, chromEnd) index because that messes up // sorting by chromStart. - dyStringPrintf(query, "IGNORE INDEX (%s) ", self->endFieldIndexName); + sqlDyStringPrintf(query, "IGNORE INDEX (%s) ", self->endFieldIndexName); if (sSelf->chrom != NULL) { uint start = sSelf->regionStart; if (minChrom) { if (differentString(minChrom, sSelf->chrom)) errAbort("annoStreamDb %s: nextRow minChrom='%s' but region chrom='%s'", sSelf->name, minChrom, sSelf->chrom); if (start < minEnd) start = minEnd; } if (self->doNextChunk && start < self->nextChunkStart) start = self->nextChunkStart; - dyStringPrintf(query, "where %s = '%s' and ", self->chromField, sSelf->chrom); + sqlDyStringPrintf(query, "where %s = '%s' and ", self->chromField, sSelf->chrom); if (self->hasBin) { if (self->doNextChunk && self->gotFinestBin) // It would be way more elegant to make a hAddBinTopLevelOnly but this will do: dyStringPrintf(query, "bin > %d and ", self->minFinestBin); hAddBinToQuery(start, sSelf->regionEnd, query); } if (self->doNextChunk) - dyStringPrintf(query, "%s >= %u and ", self->startField, self->nextChunkStart); - dyStringPrintf(query, "%s < %u and %s > %u limit %d", self->startField, sSelf->regionEnd, + sqlDyStringPrintf(query, "%s >= %u and ", self->startField, self->nextChunkStart); + sqlDyStringPrintf(query, "%s < %u and %s > %u limit %d", self->startField, sSelf->regionEnd, self->endField, start, queryMaxItems); bufferRowsFromSqlQuery(self, query->string, queryMaxItems); } else { // Genome-wide query: break it into chrom-by-chrom queries. if (self->queryChrom == NULL) self->queryChrom = self->chromList; else if (!self->doNextChunk) self->queryChrom = self->queryChrom->next; if (minChrom != NULL) { // Skip chroms that precede minChrom while (self->queryChrom != NULL && strcmp(self->queryChrom->name, minChrom) < 0) { @@ -315,45 +315,45 @@ if (self->qLm == NULL) self->qLm = lmInit(0); } } if (self->queryChrom == NULL) self->eof = TRUE; else { char *chrom = self->queryChrom->name; int start = 0; if (minChrom != NULL && sameString(chrom, minChrom)) start = minEnd; if (self->doNextChunk && start < self->nextChunkStart) start = self->nextChunkStart; uint end = annoAssemblySeqSize(self->streamer.assembly, self->queryChrom->name); - dyStringPrintf(query, "where %s = '%s' ", self->chromField, chrom); + sqlDyStringPrintf(query, "where %s = '%s' ", self->chromField, chrom); if (start > 0 || self->doNextChunk) { dyStringAppend(query, "and "); if (self->hasBin) { if (self->doNextChunk && self->gotFinestBin) // It would be way more elegant to make a hAddBinTopLevelOnly but this will do: dyStringPrintf(query, "bin > %d and ", self->minFinestBin); hAddBinToQuery(start, end, query); } if (self->doNextChunk) - dyStringPrintf(query, "%s >= %u and ", self->startField, self->nextChunkStart); + sqlDyStringPrintf(query, "%s >= %u and ", self->startField, self->nextChunkStart); // region end is chromSize, so no need to constrain startField here: - dyStringPrintf(query, "%s > %u ", self->endField, start); + sqlDyStringPrintf(query, "%s > %u ", self->endField, start); } dyStringPrintf(query, "limit %d", queryMaxItems); bufferRowsFromSqlQuery(self, query->string, queryMaxItems); // If there happens to be no items on chrom, try again with the next chrom: if (! self->eof && self->rowBuf.size == 0) asdDoQueryChunking(self, minChrom, minEnd); } } dyStringFree(&query); } static char **nextRowFromBuffer(struct annoStreamDb *self, char *minChrom, uint minEnd) /* Instead of streaming directly from self->sr, we have buffered up the results * of a chunked query; return the head of that queue. */ {