feat(sql): SQL Injection

2025-11-06 16:44:28 +01:00
parent 10110071eb
commit 59d6c911f9
14 changed files with 430 additions and 483 deletions
--- a/build/alter.go
+++ b/build/alter.go
@@ -0,0 +1,166 @@
+package build
+
+import (
+	"fmt"
+	"strings"
+
+	"git.secnex.io/secnex/pgson/schema"
+	"git.secnex.io/secnex/pgson/sql"
+)
+
+func AlterTable(s *schema.Table) (*string, error) {
+	if err := sql.ValidateIdent(s.Name); err != nil {
+		return nil, err
+	}
+
+	var ddlParts, comments []string
+
+	for _, f := range s.Schema {
+		if err := sql.ValidateIdent(f.Name); err != nil {
+			return nil, err
+		}
+
+		pgType, err := sql.ValidateType(f.Type)
+		if err != nil {
+			return nil, err
+		}
+
+		colParts := []string{sql.QuoteIdent(f.Name), pgType}
+		if f.Nullable != nil && !*f.Nullable {
+			colParts = append(colParts, "NOT NULL")
+		}
+
+		if f.Unique != nil && *f.Unique {
+			colParts = append(colParts, "UNIQUE")
+		}
+
+		if f.Default != nil && *f.Default != "" {
+			def, err := sql.ValidateDefault(*f.Default)
+			if err != nil {
+				return nil, err
+			}
+			colParts = append(colParts, "DEFAULT "+def)
+		}
+
+		if f.References != nil {
+			if err := sql.ValidateIdent(f.References.Table); err != nil {
+				return nil, err
+			}
+			if err := sql.ValidateIdent(f.References.Column); err != nil {
+				return nil, err
+			}
+			onDelete, err := sql.ValidateAction(f.References.OnDelete)
+			if err != nil {
+				return nil, err
+			}
+			onUpdate, err := sql.ValidateAction(f.References.OnUpdate)
+			if err != nil {
+				return nil, err
+			}
+			fk := fmt.Sprintf("REFERENCES %s(%s) ON DELETE %s ON UPDATE %s", sql.QuoteIdent(f.References.Table), sql.QuoteIdent(f.References.Column), onDelete, onUpdate)
+			colParts = append(colParts, fk)
+		}
+
+		ddlParts = append(ddlParts, strings.Join(colParts, " "))
+
+		if f.Comment != nil {
+			comments = append(comments, fmt.Sprintf("COMMENT ON COLUMN %s.%s IS '%s'", sql.QuoteIdent(s.Name), sql.QuoteIdent(f.Name), *f.Comment))
+		}
+	}
+
+	ddl := fmt.Sprintf(sql.DDL_ALTER_TABLE, sql.QuoteIdent(s.Name), strings.Join(ddlParts, " "))
+	return &ddl, nil
+}
+
+func AddColumn(s *schema.Table, f *schema.Field) (*string, error) {
+	if err := sql.ValidateIdent(s.Name); err != nil {
+		return nil, err
+	}
+	if err := sql.ValidateIdent(f.Name); err != nil {
+		return nil, err
+	}
+	ddl := fmt.Sprintf(sql.DDL_ADD_COLUMN, sql.QuoteIdent(s.Name), sql.QuoteIdent(f.Name))
+	return &ddl, nil
+}
+
+func DropColumn(s *schema.Table, f *schema.Field) (*string, error) {
+	if err := sql.ValidateIdent(s.Name); err != nil {
+		return nil, err
+	}
+	if err := sql.ValidateIdent(f.Name); err != nil {
+		return nil, err
+	}
+	ddl := fmt.Sprintf(sql.DDL_DROP_COLUMN, sql.QuoteIdent(s.Name), sql.QuoteIdent(f.Name))
+	return &ddl, nil
+}
+
+func AlterColumn(s *schema.Table, f *schema.Field) (*string, error) {
+	if err := sql.ValidateIdent(s.Name); err != nil {
+		return nil, err
+	}
+
+	pgType, err := sql.ValidateType(f.Type)
+	if err != nil {
+		return nil, err
+	}
+
+	colParts := []string{sql.QuoteIdent(f.Name), pgType}
+	if f.Nullable != nil && !*f.Nullable {
+		colParts = append(colParts, "NOT NULL")
+	}
+
+	ddl := fmt.Sprintf(sql.DDL_ALTER_COLUMN, sql.QuoteIdent(s.Name), sql.QuoteIdent(f.Name), strings.Join(colParts, " "))
+	if f.Default != nil && *f.Default != "" {
+		def, err := sql.ValidateDefault(*f.Default)
+		if err != nil {
+			return nil, err
+		}
+		colParts = append(colParts, "DEFAULT "+def)
+	}
+
+	return &ddl, nil
+}
+
+func AddForeignKey(s *schema.Table, f *schema.Field) (*string, error) {
+	if err := sql.ValidateIdent(s.Name); err != nil {
+		return nil, err
+	}
+	if err := sql.ValidateIdent(f.Name); err != nil {
+		return nil, err
+	}
+	ddl := fmt.Sprintf(sql.DDL_ADD_FOREIGN_KEY, sql.QuoteIdent(s.Name), sql.QuoteIdent(f.Name))
+	return &ddl, nil
+}
+
+func DropForeignKey(s *schema.Table, f *schema.Field) (*string, error) {
+	if err := sql.ValidateIdent(s.Name); err != nil {
+		return nil, err
+	}
+	if err := sql.ValidateIdent(f.Name); err != nil {
+		return nil, err
+	}
+	ddl := fmt.Sprintf(sql.DDL_DROP_FOREIGN_KEY, sql.QuoteIdent(s.Name), sql.QuoteIdent(f.Name))
+	return &ddl, nil
+}
+
+func AddConstraint(s *schema.Table, f *schema.Field) (*string, error) {
+	if err := sql.ValidateIdent(s.Name); err != nil {
+		return nil, err
+	}
+	if err := sql.ValidateIdent(f.Name); err != nil {
+		return nil, err
+	}
+	ddl := fmt.Sprintf(sql.DDL_ADD_CONSTRAINT, sql.QuoteIdent(s.Name), sql.QuoteIdent(f.Name))
+	return &ddl, nil
+}
+
+func DropConstraint(s *schema.Table, f *schema.Field) (*string, error) {
+	if err := sql.ValidateIdent(s.Name); err != nil {
+		return nil, err
+	}
+	if err := sql.ValidateIdent(f.Name); err != nil {
+		return nil, err
+	}
+	ddl := fmt.Sprintf(sql.DDL_DROP_CONSTRAINT, sql.QuoteIdent(s.Name), sql.QuoteIdent(f.Name))
+	return &ddl, nil
+}