feat(sql): SQL Injection

2025-11-06 16:44:28 +01:00
parent 10110071eb
commit 59d6c911f9
14 changed files with 430 additions and 483 deletions
--- a/build/create.go
+++ b/build/create.go
@@ -2,21 +2,109 @@ package build

 import (
 	"fmt"
+	"log"
 	"strings"

 	"git.secnex.io/secnex/pgson/schema"
-	"git.secnex.io/secnex/pgson/utils"
+	"git.secnex.io/secnex/pgson/sql"
 )

-func CreateSQL(s *schema.Table) (string, error) {
-	schemaParts := make([]string, len(s.Schema))
-	for i, field := range s.Schema {
-		schemaParts[i] = field.SQL()
+func CreateTable(s *schema.Table) (*string, error) {
+	if err := sql.ValidateIdent(s.Name); err != nil {
+		return nil, err
 	}

-	schemaParts = append(schemaParts, "\"created_at\" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP")
-	schemaParts = append(schemaParts, "\"updated_at\" TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP")
-	schemaParts = append(schemaParts, "\"deleted_at\" TIMESTAMP NULL")
-	query := fmt.Sprintf("CREATE TABLE IF NOT EXISTS %s (%s)", utils.SQLQuoteIdent(s.Name), strings.Join(schemaParts, ", "))
-	return query, nil
+	var cols, comments, pks []string
+
+	for _, f := range s.Schema {
+		if err := sql.ValidateIdent(f.Name); err != nil {
+			log.Printf("Invalid identifier: %s", f.Name)
+			return nil, err
+		}
+
+		pgType, err := sql.ValidateType(f.Type)
+		if err != nil {
+			log.Printf("Invalid type: %s", f.Type)
+			return nil, err
+		}
+
+		if f.Type == "hash" {
+			if _, ok := sql.AlgorithmMap[strings.ToLower(*f.Algorithm)]; !ok {
+				log.Printf("Invalid algorithm: %s", *f.Algorithm)
+				return nil, fmt.Errorf("invalid algorithm: %s", *f.Algorithm)
+			}
+		}
+
+		colParts := []string{sql.QuoteIdent(f.Name), pgType}
+		if f.Nullable != nil && !*f.Nullable {
+			colParts = append(colParts, "NOT NULL")
+		}
+
+		if f.Unique != nil && *f.Unique {
+			colParts = append(colParts, "UNIQUE")
+		}
+
+		// Auto-generate UUID for UUID primary keys if no default is specified
+		if f.Primary != nil && *f.Primary && f.Type == "uuid" {
+			if f.Default == nil || *f.Default == "" {
+				colParts = append(colParts, "DEFAULT gen_random_uuid()")
+			} else {
+				def, err := sql.ValidateDefault(*f.Default)
+				if err != nil {
+					return nil, err
+				}
+				colParts = append(colParts, "DEFAULT "+def)
+			}
+		} else if f.Default != nil && *f.Default != "" {
+			def, err := sql.ValidateDefault(*f.Default)
+			if err != nil {
+				return nil, err
+			}
+			colParts = append(colParts, "DEFAULT "+def)
+		}
+
+		if f.References != nil {
+			if err := sql.ValidateIdent(f.References.Table); err != nil {
+				log.Printf("Invalid references table: %s", f.References.Table)
+				return nil, err
+			}
+			if err := sql.ValidateIdent(f.References.Column); err != nil {
+				log.Printf("Invalid references column: %s", f.References.Column)
+				return nil, err
+			}
+			onDelete, err := sql.ValidateAction(f.References.OnDelete)
+			if err != nil {
+				log.Printf("Invalid on delete: %s", f.References.OnDelete)
+				return nil, err
+			}
+			onUpdate, err := sql.ValidateAction(f.References.OnUpdate)
+			if err != nil {
+				log.Printf("Invalid on update: %s", f.References.OnUpdate)
+				return nil, err
+			}
+			fk := fmt.Sprintf("REFERENCES %s(%s) ON DELETE %s ON UPDATE %s", sql.QuoteIdent(f.References.Table), sql.QuoteIdent(f.References.Column), onDelete, onUpdate)
+			colParts = append(colParts, fk)
+		}
+
+		cols = append(cols, strings.Join(colParts, " "))
+		if f.Primary != nil && *f.Primary {
+			pks = append(pks, sql.QuoteIdent(f.Name))
+		}
+
+		if f.Comment != nil {
+			comments = append(comments, fmt.Sprintf("COMMENT ON COLUMN %s.%s IS '%s'", sql.QuoteIdent(s.Name), sql.QuoteIdent(f.Name), *f.Comment))
+		}
+	}
+
+	if len(pks) > 0 {
+		cols = append(cols, "PRIMARY KEY ("+strings.Join(pks, ", ")+")")
+	}
+
+	ddl := fmt.Sprintf(sql.DDL_CREATE_TABLE, sql.QuoteIdent(s.Name), strings.Join(cols, ",\n  "))
+	if len(comments) > 0 {
+		ddl += "\n" + strings.Join(comments, "\n")
+	}
+
+	log.Printf("DDL: %s", ddl)
+	return &ddl, nil
 }