HomePhabricator

Support %LA (AND), %LO (OR) and %LQ (comma) conversions for qsprintf() to…

Authored by epriestley on Nov 7 2018, 12:39 AM.

Description

Support %LA (AND), %LO (OR) and %LQ (comma) conversions for qsprintf() to improve safety

Summary:
Depends on D19782. Ref T13217. Ref T13216. Ref T6960. We currently construct some queries by passing implode(...) directly to qsprintf().

I believe we can cover all these cases (or, at least, almost all these cases) with conversions for imploding on AND, OR, or comma. This will ultimately let us make %Q safer.

Test Plan: Played around with these in a toy qsprintf() script; upcoming changes will convert Phabricator callsites more aggressively.

Reviewers: amckinley

Reviewed By: amckinley

Maniphest Tasks: T13217, T13216, T6960

Differential Revision: https://secure.phabricator.com/D19783