ORMLite illegal fragment matching

cdmackie · June 30, 2017, 6:05pm

ServiceStack/ServiceStack.OrmLite/blob/master/src/ServiceStack.OrmLite/OrmLiteUtils.cs#L456


public static string SqlTableRaw(this string tableName, IOrmLiteDialectProvider dialect = null)
{
    return (dialect ?? OrmLiteConfig.DialectProvider).NamingStrategy.GetTableName(tableName);
}


public static string SqlValue(this object value)
{
    return "{0}".SqlFmt(value);
}


public static Regex VerifyFragmentRegEx = new Regex("([^\\w]|^)+(--|;--|;|%|/\\*|\\*/|@@|@|char|nchar|varchar|nvarchar|alter|begin|cast|create|cursor|declare|delete|drop|end|exec|execute|fetch|insert|kill|open|select|sys|sysobjects|syscolumns|table|update)([^\\w]|$)+",
    RegexOptions.Singleline | RegexOptions.Compiled | RegexOptions.IgnoreCase);


public static Regex VerifySqlRegEx = new Regex("([^\\w]|^)+(--|;--|;|%|/\\*|\\*/|@@|@|char|nchar|varchar|nvarchar|alter|begin|cast|create|cursor|declare|delete|drop|end|exec|execute|fetch|insert|kill|open|table|update)([^\\w]|$)+",
    RegexOptions.Singleline | RegexOptions.Compiled | RegexOptions.IgnoreCase);


public static Func<string,string> SqlVerifyFragmentFn { get; set; }


public static bool isUnsafeSql(string sql, Regex verifySql)
{
    if (sql == null)

I don’t think .Net supports POSIX regular expression syntax, i.e. “[:alnum:]”.

This means that expression is too matchy. For example, it matches “somecreatedate”

You can replace “[:alnum:]_” with just “\w”,

public static Regex VerifyFragmentRegEx = new Regex("([^\\w]|^)+(--|;--|;|%|/\\*|\\*/|@@|@|char|nchar|varchar|nvarchar|alter|begin|cast|create|cursor|declare|delete|drop|end|exec|execute|fetch|insert|kill|open|select|sys|sysobjects|syscolumns|table|update)([^\\w]|$)+",
    RegexOptions.Singleline | RegexOptions.Compiled | RegexOptions.IgnoreCase);

mythz · June 30, 2017, 7:02pm

ok thx, added in this commit which is available from v4.5.13 that’s now available on MyGet.