Page MenuHomePhabricator

Support %LA (AND), %LO (OR) and %LQ (comma) conversions for qsprintf() to improve safety
ClosedPublic

Authored by epriestley on Nov 7 2018, 12:45 AM.

Details

Summary

Depends on D19782. Ref T13217. Ref T13216. Ref T6960. We currently construct some queries by passing implode(...) directly to qsprintf().

I believe we can cover all these cases (or, at least, almost all these cases) with conversions for imploding on AND, OR, or comma. This will ultimately let us make %Q safer.

Test Plan

Played around with these in a toy qsprintf() script; upcoming changes will convert Phabricator callsites more aggressively.

Diff Detail

Repository
rPHU libphutil
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

epriestley created this revision.Nov 7 2018, 12:45 AM
epriestley requested review of this revision.Nov 7 2018, 12:45 AM
amckinley accepted this revision.Nov 7 2018, 8:57 PM
This revision is now accepted and ready to land.Nov 7 2018, 8:57 PM
This revision was automatically updated to reflect the committed changes.