Implement SQL Injection Prevention Measures

- Introduced a SQLSanitizer module for sanitizing identifiers and escaping LIKE patterns.
- Added parameterized query support to prevent SQL injection vulnerabilities.
- Updated filter query generation to utilize parameterized queries and sanitize user inputs.
- Enhanced the execution layer to support parameterized query execution for both PostgreSQL and SQLite.
- Added validation functions for field names and operators to ensure safe query construction.
- Implemented comprehensive tests for SQL injection prevention, including basic parameter injection, field name validation, and LIKE pattern escaping.

Author: PingoLee

Project.toml

@@ -8,6 +8,7 @@ BenchmarkTools = "6e4b80f9-dd63-53aa-95a3-0cdb28fa8baf"
 CSV = "336ed68f-0bac-5ca0-87d4-7b16caf5d00b"
 DataFrames = "a93c6f00-e57d-5684-b7b6-d8193f3e46c0"
 Dates = "ade2ca70-3891-5945-98fb-dc099432e06a"
+Decimals = "abce61dc-4473-55a0-ba07-351d65e31d42"
 Distributed = "8ba89e20-285c-5b6f-9357-94700520ee1b"
 Infiltrator = "5903a43b-9cc3-4c30-8d17-598619ec4e9b"
 Inflector = "6d011eab-0732-4556-8808-e463c76bf3b6"
@@ -27,6 +28,7 @@ XLSX = "fdbf4ff8-1666-58a4-91e7-1b58723a45e0"
 YAML = "ddb6d928-2868-570f-bddf-ab3f9cf99eb6"
 
 [compat]
+Decimals = "0.4.1"
 Infiltrator = "1.8.3"
 OrderedCollections = "1.7.0"
 Printf = "1.11.0"

src/Configuration.jl

@@ -1,7 +1,7 @@
 module Configuration
 
 import YAML, Logging
-import PormG: SQLConn, PormGPostgres, PormGSQLite, config
+import PormG: SQLConn, PormGPostgres, PormGPostgresParam, PormGSQLite, config
 import PormG: PORMG_DB_CONFIG_FILE_NAME, DB_PATH, MODEL_FILE, DATETIME_FORMAT
 import PormG: Generator
 import PormG.Infiltrator: @infiltrate
@@ -375,30 +375,46 @@ function is_connection_error(e, connection::PormGPostgres)
            # occursin("connection timeout", msg)
 end
 
-function fetch(connection::PormGPostgres, sql::String; conn::Union{Nothing, LibPQ.Connection} = nothing)
+function libpq_execute(conn::LibPQ.Connection, sql::String, params::Nothing)
+  return LibPQ.execute(conn, sql)  
+end
+function libpq_execute(conn::LibPQ.Connection, sql::String, params::Vector{Any})
+  return LibPQ.execute(conn, sql, params) 
+end
+libpq_execute(conn::LibPQ.Connection, sql::String, params::PormGPostgresParam) = libpq_execute(conn, sql, params.parameters)
+
+function fetch(connection::PormGPostgres, sql::String; 
+  conn::Union{Nothing, LibPQ.Connection} = nothing, 
+  params::Union{Nothing, PormGPostgresParam} = nothing)
   @infiltrate false
   conn === nothing && (conn = acquire_connection(connection))
   try
-    return LibPQ.execute(conn, sql)
+    return libpq_execute(conn, sql, params)
   catch e
     @infiltrate
     if is_connection_error(e, connection)
       @warn "Lost connection to database. Attempting to reconnect..."
       conn = reconnect_db(connection, conn)
-      return LibPQ.execute(conn, sql)
+      return libpq_execute(conn, sql, params)
     end
     @error "Failed to execute SQL query: $e"
     throw(e)
   finally
     release_connection(connection, conn)
   end
 end
-fetch(settings::SQLConn, sql::String; conn::Union{Nothing, LibPQ.Connection} = nothing) = fetch(settings.connections, sql; conn=conn)
-
-function with_transaction(pool::PormGPostgres, sql::String; conn::Union{Nothing, LibPQ.Connection} = nothing, release_conn::Bool = false)
+fetch(settings::SQLConn, sql::String; conn::Union{Nothing, LibPQ.Connection} = nothing, params::Union{Nothing, PormGPostgresParam} = nothing) = fetch(settings.connections, sql; conn=conn, params=params)
+fetch(settings::SQLConn, sql::String, params::PormGPostgresParam; conn::Union{Nothing, LibPQ.Connection} = nothing) = fetch(settings.connections, sql; conn=conn, params=params)
+fetch(settings::PormGPostgres, sql::String, params::PormGPostgresParam; conn::Union{Nothing, LibPQ.Connection} = nothing) = fetch(settings, sql; conn=conn, params=params)
+
+function with_transaction(pool::PormGPostgres, sql::String; 
+  conn::Union{Nothing, LibPQ.Connection} = nothing, 
+  release_conn::Bool = false, 
+  params::Union{Nothing, PormGPostgresParam} = nothing)
+  
   conn === nothing && (conn = acquire_connection(pool))
   try
-    return LibPQ.execute(conn, sql), conn
+    return libpq_execute(conn, sql, params), conn
   catch e
     @infiltrate   
     @error "Failed to execute SQL transaction, rolling back: $e"
@@ -409,7 +425,8 @@ function with_transaction(pool::PormGPostgres, sql::String; conn::Union{Nothing,
     end
   end
 end
-with_transaction(pool::SQLConn, sql::String; conn::Union{Nothing, LibPQ.Connection} = nothing, release_conn::Bool = false) = with_transaction(pool.connections, sql; conn=conn, release_conn=release_conn)
+with_transaction(pool::SQLConn, sql::String; conn::Union{Nothing, LibPQ.Connection} = nothing, release_conn::Bool = false, params::Union{Nothing, PormGPostgresParam} = nothing) = with_transaction(pool.connections, sql; conn=conn, release_conn=release_conn, params=params)
+
 
 
 

src/Dialect.jl

@@ -464,17 +464,15 @@ end
 # Function to deal with operators
 #
 
-function contains(conn::PormGPostgres, column::String, value::String)::String
-  value = replace(value, "'" => "")
-  return """$(column) LIKE '%$(value)%'"""
+function contains(conn::PormGPostgres, column::String, value::String)::String 
+  return "$(column) LIKE $(value)"
 end
 function contains(conn::PormGPostgres, column::String, value)
   throw(ArgumentError("The value must be a String"))
   return nothing
 end
 function icontains(conn::PormGPostgres, column::String, value::String)::String
-  value = replace(value, "'" => "") 
-  return """$(column) ILIKE '%$(value)%'"""
+  return "$(column) ILIKE $(value)"
 end
 function icontains(conn::PormGPostgres, column::String, value)
   throw(ArgumentError("The value must be a String"))

src/Generator.jl

@@ -61,9 +61,9 @@ function create_db_folder_and_yml(;path::String = DB_PATH)::Nothing
     nothing
 end
 
-function generate_models_from_db(file::String, Instructions::Vector{Any}, settings::SQLConn) :: Nothing 
+function generate_models_from_db(file::String, Instructions::Vector{Any}, settings::SQLConn; path::String = MODEL_PATH) :: Nothing 
 
-  open(joinpath(MODEL_PATH, file), "w") do f
+  open(joinpath(path, file), "w") do f
     write(f, """module $(basename(file) |> x -> replace(x, ".jl" => ""))\n
     import PormG.Models
     import PormG.Models: RESTRICT, CASCADE, SET_NULL, SET_DEFAULT, DO_NOTHING

src/Migrations.jl

@@ -1203,7 +1203,7 @@ function import_models_from_django(
 
   end
 
-  generate_models_from_db(file, Instructions, settings)
+  generate_models_from_db(file, Instructions, settings, path=db)
 end
 
 function parse_class(model_py_string::String)

src/Models.jl

@@ -7,6 +7,8 @@ import PormG: SQLConn, config, Configuration
 import PormG: CASCADE, RESTRICT, SET_NULL, SET_DEFAULT, SET, DO_NOTHING, PROTECT
 using Printf
 import Base.deepcopy
+using Decimals
+
 
 import PormG.Infiltrator: @infiltrate
 
@@ -331,35 +333,40 @@ end
 #
 
 function format_text_sql(value::Union{Int, Date, DateTime, ZonedDateTime})
-    return string("'", value, "'")        
+    return string(value)        
 end
 function format_text_sql(value::Union{Missing, Nothing})
-    return "null"
+    return missing
 end
 function format_text_sql(value::Bool)
-    return value ? "'true'" : "'false'"
+  return value
+    # return value ? "'true'" : "'false'"
 end
 function format_text_sql(value::AbstractString)
-    return string("'", replace(value, "'" => "`"), "'")    
+  return value
+    # return string("'", replace(value, "'" => "`"), "'")    
 end
 function format_text_sql(value::AbstractArray)
   arrayref::Vector{String} = []
   for v in value
     push!(arrayref, v |> format_text_sql)
   end
   @infiltrate false
-  return string("(", join(arrayref, ","), ")")
+  # return string("(", join(arrayref, ","), ")")
+  return arrayref
 end
 
 function format_number_sql(value::Integer)
-    return string(value)    
+  return value
+    # return string(value)    
 end
 function format_number_sql(value::Union{Missing, Nothing})
-    return "null"
+    return missing
 end
 function format_number_sql(value::Union{Float16, Float32, Float64})
   # Use @sprintf to avoid scientific notation and ensure full precision
-  return string("'", @sprintf("%.17g", value), "'")
+  # return string("'", @sprintf("%.17g", value), "'")
+  return @sprintf("%.17g", value)
 end
 function format_number_sql(value::AbstractString)
   # try integer first
@@ -376,58 +383,71 @@ function format_number_sql(value::AbstractString)
   end
 end
 function format_number_sql(value::AbstractArray)
-  arrayref::Vector{String} = []
+  arrayref::Vector{Union{String, Integer, Missing}} = []
   for v in value
     push!(arrayref, v |> format_number_sql)
   end
-  return string("(", join(arrayref, ","), ")")
+  # return string("(", join(arrayref, ","), ")")
+  return arrayref
+end
+function format_number_sql(value::Decimals.Decimal)
+  try
+    return string(value)
+  catch e
+    @error("Failed to format Decimals.Decimal value: $(e)", value=value)
+    throw(e)
+  end
 end
 
 function format_bool_sql(value::Integer)
     if value in [0, 1] == false
         throw(ArgumentError("The value must be 0, 1, true or false"))
     end
-    return value == 1 ? "true" : "false"
+    return value == 1 ? true : false
 end
 function format_bool_sql(value::Union{Missing, Nothing})
-    return "null"
+    return missing
 end
 function format_bool_sql(value::Bool)
-    return value ? "true" : "false"
+    return value
 end
 
 function format_date_sql(value::Date)
-    return string("'", value, "'")    
+    # return string("'", value, "'")    
+  return value |> string
 end
 function format_date_sql(value::Union{Missing, Nothing})
-    return "null"
+    return missing
 end
 function format_date_sql(value::DateTime)
-  return string("'", value |> Dates.Date, "'")
+  # return string("'", value |> Dates.Date, "'")
+  return value |> Dates.Date |> string
 end
 function format_date_sql(value::ZonedDateTime)
-  return string("'", value |> Dates.Date, "'")
+  # return string("'", value |> Dates.Date, "'")
+  return value |> Dates.Date |> string
 end
 function format_date_sql(value::AbstractString)
   if occursin(r"^\d{4}-\d{2}-\d{2}$", value)
-    return string("'", value, "'")
+    return value
   else
     throw(ArgumentError("The date $value is invalid"))
   end  
 end
-function format_date_sql()
+function format_date_sql(value)
   throw(ArgumentError("The date must be a Date, DateTime, ZonedDateTime or a string in the format YYYY-MM-DD"))
 end
 
 
 function format_timezone_sql(value::String; format::String=DATETIME_FORMAT)
-  return validate_timezone(value, format) ? string("'", value, "'") : throw(ArgumentError("The timezone $value is invalid"))  
+  return validate_timezone(value, format) ? string(value) : throw(ArgumentError("The timezone $value is invalid"))  
 end
 function format_timezone_sql(value::Union{Missing, Nothing})
-    return "null"
+    return missing
 end
 function format_timezone_sql(value::ZonedDateTime)
-    return string("'", value, "'")    
+    # return string("'", value, "'")    
+  return value |> string
 end
 function format_timezone_sql(value::DateTime, timezone::String)
   # function used just in create 
@@ -436,7 +456,7 @@ end
 
 function format_yyyy_mm(value::String)
   if occursin(r"^\d{4}-\d{2}$", value)
-    return string("'", value, "'")
+    return value
   else
     throw(ArgumentError("The value $value is invalid, it must be in the format YYYY-MM"))
   end  
@@ -445,7 +465,7 @@ function format_yyyy_mm(value::Integer)
   value = string(value)
   if length(value) == 6
     # Format as YYYY-MM
-    return string("'", value[1:4], "-", value[5:6], "'")
+    return string(value[1:4], "-", value[5:6])
   else
     throw(ArgumentError("The value $value must be a 6-digit integer in the format YYYYMM or a string in the format YYYY-MM"))
   end
@@ -1026,7 +1046,28 @@ end
   formater::Function = format_date_sql
 end
 
-function DateField(; verbose_name=nothing, unique=false, blank=false, null=false, db_index=false, default=nothing, editable=false, auto_now=false, auto_now_add=false)
+function DateField(; kwargs...)
+  # List of accepted parameters
+  accepted = Set([
+      :verbose_name, :unique, :blank, :null, :db_index, :default, :editable, :auto_now, :auto_now_add
+  ])
+  # Check for unexpected parameters
+  for (k, v) in kwargs
+      if !(k in accepted)
+          @warn "Unexpected parameter for DateField. It will be ignored." field="DateField" param=k value=v
+      end
+  end
+  # Extract parameters with defaults
+  verbose_name = get(kwargs, :verbose_name, nothing)
+  unique = get(kwargs, :unique, false)
+  blank = get(kwargs, :blank, false)
+  null = get(kwargs, :null, false)
+  db_index = get(kwargs, :db_index, false)
+  default = get(kwargs, :default, nothing)
+  editable = get(kwargs, :editable, false)
+  auto_now = get(kwargs, :auto_now, false)
+  auto_now_add = get(kwargs, :auto_now_add, false)
+
   # Validate verbose_name
   !(verbose_name isa Union{Nothing, String}) && throw(ArgumentError("The verbose_name must be a String or nothing"))
   # Validate default

src/PormG.jl

@@ -15,6 +15,7 @@ using LibPQ
 abstract type PormGAbstractType end
 abstract type SQLConn <: PormGAbstractType end
 abstract type PormGPostgres <: SQLConn end
+abstract type PormGPostgresParam <: PormGPostgres end
 abstract type PormGSQLite <: SQLConn end
 abstract type SQLObject <: PormGAbstractType end
 abstract type SQLObjectHandler <: SQLObject end