connection: interpolate json.RawMessage as string #1058

alexsn · 2020-02-08T18:42:07Z

json encoded data is represented as bytes however it should be
interpolated as a string.

Signed-off-by: Alex Snast [email protected]

Description

On argument interpolation treat json.RawMessage as a string instead of []bytes to prevents _binary statement injection.

Checklist

Code compiles correctly
Created tests which fail without the change (if possible)
All tests passing
Added myself / the copyright holder to the AUTHORS file

json encoded data is represented as bytes however it should be interpolated as a string. Signed-off-by: Alex Snast <[email protected]>

julienschmidt

LGTM. Thanks!

connection: interpolate json.RawMessage as string (go-sql-driver#1058)

Following go-sql-driver#1058, in order for the driver.Value to get as a json.RawMessage, the converter should accept it as a valid value, and handle it as bytes in case where interpolation is disabled

…ver#1058)" This reverts commit c4f1976.

Following go-sql-driver#1058, in order for the driver.Value to get as a json.RawMessage, the converter should accept it as a valid value, and handle it as bytes in case where interpolation is disabled

Following #1058, in order for the driver.Value to get as a json.RawMessage, the converter should accept it as a valid value, and handle it as bytes in case where interpolation is disabled

dolmen · 2020-03-26T10:28:29Z

I'm sad this has been merged.
The mysql driver now has a strong dependency on a particular implementation of JSON encoding/decoding (this implementation being in the stdlib is not an excuse). How the growth of dependencies will stop if such patches are accepted?

This is just a user error to pass a json.RawMessage to the driver as this is not a driver.Value. The user should just not pass json.RawMessage. Use instead a type that wraps json.RawMessage and implements driver.Valuer and sql.Scanner, but not in the driver itself.

I wrote this function that allows to wrap a json.RawMessage (or any other type that is is serialized as JSON in a DB column), and this doesn't require to patch any SQL drivers.

var errInvalidJSONWrapperValue = errors.New("invalid target value for sqlutil.JSON wrapper")
var errInvalidJSONValue = errors.New("invalid value for sqlutil.JSON target")

// JSON is an helper to wrap a value for I/O to a database column as a JSON string
func JSON(p interface{}) driver.Value {
	if p == nil {
		panic(errInvalidJSONWrapperValue)
	}
	v := reflect.ValueOf(p)
	if v.Kind() == reflect.Ptr && !v.IsNil() && v.Elem().CanSet() {
		return jsonScanner{jsonValuer{p}}
	} else {
		return jsonValuer{p}
	}
}

type jsonValuer struct {
	target interface{}
}

type jsonScanner struct {
	jsonValuer
}

// Value implements interface driver.Valuer for both jsonValuer and jsonScanner
func (j jsonValuer) Value() (driver.Value, error) {
	return json.Marshal(j.target)
}

// Scan implements interface sql.Scanner
func (j jsonScanner) Scan(value interface{}) error {
	switch value := value.(type) {
	case []byte:
		return json.Unmarshal(value, j.target)
	case string:
		return json.Unmarshal([]byte(value), j.target)
	default:
		target := reflect.ValueOf(j.target)
		source := reflect.ValueOf(value)
		if value == nil {
			source = reflect.Zero(target.Elem().Type())
		}
		if !source.Type().AssignableTo(target.Elem().Type()) {
			return errInvalidJSONValue
		}
		target.Elem().Set(source)
		return nil
	}
}

alexsn · 2020-03-26T11:40:12Z

The fact that we use types from stdlib doesn't add any dependency so I'm not sure what you mean by saying "How the growth of dependencies will stop ...".

json encoded data is represented as bytes however it should be interpolated as a string Fixes go-sql-driver#819

…l-driver#1059) Following go-sql-driver#1058, in order for the driver.Value to get as a json.RawMessage, the converter should accept it as a valid value, and handle it as bytes in case where interpolation is disabled

json encoded data is represented as bytes however it should be interpolated as a string Fixes go-sql-driver#819

…l-driver#1059) Following go-sql-driver#1058, in order for the driver.Value to get as a json.RawMessage, the converter should accept it as a valid value, and handle it as bytes in case where interpolation is disabled

connection: interpolate json.RawMessage as string (#819)

Loading status checks…

5fb27bb

json encoded data is represented as bytes however it should be interpolated as a string. Signed-off-by: Alex Snast <[email protected]>

julienschmidt approved these changes Feb 9, 2020

View changes

julienschmidt changed the title ~~connection: interpolate json.RawMessage as string (#819)~~ connection: interpolate json.RawMessage as string Feb 9, 2020

julienschmidt merged commit c4f1976 into go-sql-driver:master Feb 9, 2020
3 checks passed

3 checks passed

WIP Ready for review
Details

continuous-integration/travis-ci/pr The Travis CI build passed
Details

coverage/coveralls Coverage increased (+0.2%) to 81.608%
Details

alexsn deleted the alexsn:interpolate_jsonrawmsg branch Feb 9, 2020

a8m mentioned this pull request Feb 10, 2020

stmt: add json.RawMessage for converter and prepared statement #1059

Merged

4 of 5 tasks complete

bitcoinbarron2 added a commit to bitcoinbarron2/mysql that referenced this pull request Feb 18, 2020

Revert "connection: interpolate json.RawMessage as string (go-sql-dri…

39baf7c

…ver#1058)" This reverts commit c4f1976.

sthagen mentioned this pull request Feb 18, 2020

stmt: add json.RawMessage for converter and prepared statement (#1059) sthagen/mysql#10

Merged

0 of 5 tasks complete

tz70s added a commit to tz70s/mysql that referenced this pull request Sep 5, 2020

connection: interpolate json.RawMessage as string (go-sql-driver#1058)

411d701

json encoded data is represented as bytes however it should be interpolated as a string Fixes go-sql-driver#819

tz70s added a commit to tz70s/mysql that referenced this pull request Sep 5, 2020

connection: interpolate json.RawMessage as string (go-sql-driver#1058)

c5008b7

json encoded data is represented as bytes however it should be interpolated as a string Fixes go-sql-driver#819

Oct	FEB	Mar
	02
2020	2021	2022

go-sql-driver / mysql

connection: interpolate json.RawMessage as string #1058

connection: interpolate json.RawMessage as string #1058

alexsn commented Feb 8, 2020

julienschmidt left a comment

dolmen commented Mar 26, 2020 •

edited

alexsn commented Mar 26, 2020 •

edited

go-sql-driver / mysql

connection: interpolate json.RawMessage as string #1058

connection: interpolate json.RawMessage as string #1058

Conversation

alexsn commented Feb 8, 2020

Description

Checklist

julienschmidt left a comment

dolmen commented Mar 26, 2020 • edited

alexsn commented Mar 26, 2020 • edited

dolmen commented Mar 26, 2020 •

edited

alexsn commented Mar 26, 2020 •

edited