Skip to content

Commit 12d7f5c

Browse files
committed
Allows :dql_parameters with ARRAY_* functions
before it was only possible to do `ARRAY_APPEND(e.myarray, 'a_literal')` so it was impossible to have the value coming from php (without resorting to DQL injection) We now allow also the following syntax `ARRAY_APPEND(e.myarray, :foobar)`
1 parent 79dcdc2 commit 12d7f5c

File tree

10 files changed

+16
-6
lines changed

10 files changed

+16
-6
lines changed

src/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayAppend.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ protected function customiseFunction(): void
1818
{
1919
$this->setFunctionPrototype('array_append(%s, %s)');
2020
$this->addNodeMapping('StringPrimary');
21-
$this->addNodeMapping('Literal');
21+
$this->addNodeMapping('ArithmeticPrimary');
2222
}
2323
}

src/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayLength.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ protected function customiseFunction(): void
1818
{
1919
$this->setFunctionPrototype('array_length(%s, %s)');
2020
$this->addNodeMapping('StringPrimary');
21-
$this->addNodeMapping('Literal');
21+
$this->addNodeMapping('ArithmeticPrimary');
2222
}
2323
}

src/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayPrepend.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ class ArrayPrepend extends BaseFunction
1717
protected function customiseFunction(): void
1818
{
1919
$this->setFunctionPrototype('array_prepend(%s, %s)');
20-
$this->addNodeMapping('Literal');
20+
$this->addNodeMapping('ArithmeticPrimary');
2121
$this->addNodeMapping('StringPrimary');
2222
}
2323
}

src/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayRemove.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ protected function customiseFunction(): void
1818
{
1919
$this->setFunctionPrototype('array_remove(%s, %s)');
2020
$this->addNodeMapping('StringPrimary');
21-
$this->addNodeMapping('Literal');
21+
$this->addNodeMapping('ArithmeticPrimary');
2222
}
2323
}

src/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayReplace.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ protected function customiseFunction(): void
1818
{
1919
$this->setFunctionPrototype('array_replace(%s, %s, %s)');
2020
$this->addNodeMapping('StringPrimary');
21-
$this->addNodeMapping('Literal');
22-
$this->addNodeMapping('Literal');
21+
$this->addNodeMapping('ArithmeticPrimary');
22+
$this->addNodeMapping('ArithmeticPrimary');
2323
}
2424
}

tests/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayAppendTest.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ protected function getExpectedSqlStatements(): array
2121
return [
2222
'SELECT array_append(c0_.array1, 1989) AS sclr_0 FROM ContainsArrays c0_',
2323
"SELECT array_append(c0_.array1, 'country') AS sclr_0 FROM ContainsArrays c0_",
24+
"SELECT array_append(c0_.array1, ?) AS sclr_0 FROM ContainsArrays c0_",
2425
];
2526
}
2627

@@ -29,6 +30,7 @@ protected function getDqlStatements(): array
2930
return [
3031
\sprintf('SELECT ARRAY_APPEND(e.array1, 1989) FROM %s e', ContainsArrays::class),
3132
\sprintf("SELECT ARRAY_APPEND(e.array1, 'country') FROM %s e", ContainsArrays::class),
33+
\sprintf("SELECT ARRAY_APPEND(e.array1, :dql_parameter) FROM %s e", ContainsArrays::class),
3234
];
3335
}
3436
}

tests/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayLengthTest.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,15 @@ protected function getExpectedSqlStatements(): array
2020
{
2121
return [
2222
'SELECT array_length(c0_.array1, 1) AS sclr_0 FROM ContainsArrays c0_',
23+
'SELECT array_length(c0_.array1, ?) AS sclr_0 FROM ContainsArrays c0_',
2324
];
2425
}
2526

2627
protected function getDqlStatements(): array
2728
{
2829
return [
2930
\sprintf('SELECT ARRAY_LENGTH(e.array1, 1) FROM %s e', ContainsArrays::class),
31+
\sprintf('SELECT ARRAY_LENGTH(e.array1, :dql_parameter) FROM %s e', ContainsArrays::class),
3032
];
3133
}
3234
}

tests/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayPrependTest.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ protected function getExpectedSqlStatements(): array
2121
return [
2222
'SELECT array_prepend(1885, c0_.array1) AS sclr_0 FROM ContainsArrays c0_',
2323
"SELECT array_prepend('red', c0_.array1) AS sclr_0 FROM ContainsArrays c0_",
24+
"SELECT array_prepend(?, c0_.array1) AS sclr_0 FROM ContainsArrays c0_",
2425
];
2526
}
2627

@@ -29,6 +30,7 @@ protected function getDqlStatements(): array
2930
return [
3031
\sprintf('SELECT ARRAY_PREPEND(1885, e.array1) FROM %s e', ContainsArrays::class),
3132
\sprintf("SELECT ARRAY_PREPEND('red', e.array1) FROM %s e", ContainsArrays::class),
33+
\sprintf("SELECT ARRAY_PREPEND(:dql_parameter, e.array1) FROM %s e", ContainsArrays::class),
3234
];
3335
}
3436
}

tests/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayRemoveTest.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ protected function getExpectedSqlStatements(): array
2121
return [
2222
'SELECT array_remove(c0_.array1, 1944) AS sclr_0 FROM ContainsArrays c0_',
2323
"SELECT array_remove(c0_.array1, 'peach') AS sclr_0 FROM ContainsArrays c0_",
24+
"SELECT array_remove(c0_.array1, ?) AS sclr_0 FROM ContainsArrays c0_",
2425
];
2526
}
2627

@@ -29,6 +30,7 @@ protected function getDqlStatements(): array
2930
return [
3031
\sprintf('SELECT ARRAY_REMOVE(e.array1, 1944) FROM %s e', ContainsArrays::class),
3132
\sprintf("SELECT ARRAY_REMOVE(e.array1, 'peach') FROM %s e", ContainsArrays::class),
33+
\sprintf("SELECT ARRAY_REMOVE(e.array1, :dql_parameter) FROM %s e", ContainsArrays::class),
3234
];
3335
}
3436
}

tests/MartinGeorgiev/Doctrine/ORM/Query/AST/Functions/ArrayReplaceTest.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ protected function getExpectedSqlStatements(): array
2121
return [
2222
'SELECT array_replace(c0_.array1, 1939, 1957) AS sclr_0 FROM ContainsArrays c0_',
2323
"SELECT array_replace(c0_.array1, 'green', 'mint') AS sclr_0 FROM ContainsArrays c0_",
24+
"SELECT array_replace(c0_.array1, 'green', ?) AS sclr_0 FROM ContainsArrays c0_",
2425
];
2526
}
2627

@@ -29,6 +30,7 @@ protected function getDqlStatements(): array
2930
return [
3031
\sprintf('SELECT ARRAY_REPLACE(e.array1, 1939, 1957) FROM %s e', ContainsArrays::class),
3132
\sprintf("SELECT ARRAY_REPLACE(e.array1, 'green', 'mint') FROM %s e", ContainsArrays::class),
33+
\sprintf("SELECT ARRAY_REPLACE(e.array1, 'green', :dql_parameter) FROM %s e", ContainsArrays::class),
3234
];
3335
}
3436
}

0 commit comments

Comments
 (0)