Page MenuHomePhabricator

Support %LA (AND), %LO (OR) and %LQ (comma) conversions for qsprintf() to improve safety
ClosedPublic

Authored by epriestley on Nov 7 2018, 12:45 AM.
Tags
None
Referenced Files
F18095191: D19783.id.diff
Thu, Aug 7, 10:33 PM
F17926877: D19783.diff
Wed, Jul 30, 1:47 PM
F17846798: D19783.id.diff
Jul 27 2025, 5:20 AM
F17840465: D19783.diff
Jul 26 2025, 9:10 PM
F17840361: D19783.diff
Jul 26 2025, 9:04 PM
F17732346: D19783.id.diff
Jul 20 2025, 4:34 AM
F17731327: D19783.id47249.diff
Jul 20 2025, 1:08 AM
F17703970: D19783.diff
Jul 16 2025, 2:53 AM
Subscribers
None

Details

Summary

Depends on D19782. Ref T13217. Ref T13216. Ref T6960. We currently construct some queries by passing implode(...) directly to qsprintf().

I believe we can cover all these cases (or, at least, almost all these cases) with conversions for imploding on AND, OR, or comma. This will ultimately let us make %Q safer.

Test Plan

Played around with these in a toy qsprintf() script; upcoming changes will convert Phabricator callsites more aggressively.

Diff Detail

Repository
rPHU libphutil
Lint
Lint Not Applicable
Unit
Tests Not Applicable