Page MenuHomePhabricator

Support %LA (AND), %LO (OR) and %LQ (comma) conversions for qsprintf() to improve safety
ClosedPublic

Authored by epriestley on Nov 7 2018, 12:45 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Mar 19, 3:48 PM
Unknown Object (File)
Tue, Mar 12, 3:01 AM
Unknown Object (File)
Feb 3 2024, 7:47 PM
Unknown Object (File)
Jan 9 2024, 9:21 AM
Unknown Object (File)
Dec 29 2023, 1:43 PM
Unknown Object (File)
Dec 28 2023, 4:48 PM
Unknown Object (File)
Dec 25 2023, 8:10 AM
Unknown Object (File)
Dec 24 2023, 4:58 PM
Subscribers
None

Details

Summary

Depends on D19782. Ref T13217. Ref T13216. Ref T6960. We currently construct some queries by passing implode(...) directly to qsprintf().

I believe we can cover all these cases (or, at least, almost all these cases) with conversions for imploding on AND, OR, or comma. This will ultimately let us make %Q safer.

Test Plan

Played around with these in a toy qsprintf() script; upcoming changes will convert Phabricator callsites more aggressively.

Diff Detail

Repository
rPHU libphutil
Branch
qobject3
Lint
Lint Passed
Unit
Tests Passed
Build Status
Buildable 21098
Build 28674: Run Core Tests
Build 28673: arc lint + arc unit