Changeset 32374

Timestamp:

05/06/2015 06:04:50 AM (9 years ago)

Author:

pento

Message:

WPDB: When sanity checking query character sets, there's no need to check queries that don't return user data.

See #32104.

Location:

trunk

Files:

• src/wp-includes/wp-db.php (modified) (2 diffs)
• tests/phpunit/tests/db/charset.php (modified) (1 diff)

trunk/src/wp-includes/wp-db.php

@@ -2532 +2532 @@
         // We don't need to check the collation for queries that don't read data.
         $query = ltrim( $query, "\r\n\t (" );
-        if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $query ) ) {
+        if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $query ) ) {
             return true;
         }
@@ -2742 +2742 @@
      */
     protected function strip_invalid_text_from_query( $query ) {
+        // We don't need to check the collation for queries that don't read data.
+        $trimmed_query = ltrim( $query, "\r\n\t (" );
+        if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $trimmed_query ) ) {
+            return $query;
+        }
+
         $table = $this->get_table_from_query( $query );
         if ( $table ) {

trunk/tests/phpunit/tests/db/charset.php

@@ -644 +644 @@
 
     /**
+     * @ticket 32104
+     */
+    function data_dont_strip_text_from_schema_queries() {
+        // An obviously invalid and fake table name.
+        $table_name = "\xff\xff\xff\xff";
+
+        $queries = array(
+            "SHOW CREATE TABLE $table_name",
+            "DESCRIBE $table_name",
+            "DESC $table_name",
+            "EXPLAIN SELECT * FROM $table_name",
+            "CREATE $table_name( a VARCHAR(100))",
+        );
+
+        foreach ( $queries as &$query ) {
+            $query = array( $query );
+        }
+        unset( $query );
+
+        return $queries;
+    }
+
+    /**
+     * @dataProvider data_dont_strip_text_from_schema_queries
+     * @ticket 32104
+     */
+    function test_dont_strip_text_from_schema_queries( $query ) {
+        $return = self::$_wpdb->strip_invalid_text_from_query( $query );
+        $this->assertEquals( $query, $return );
+    }
+
+    /**
      * @ticket 21212
      */