Patched potential security risk

This commit is contained in:
Marvin Scham
2023-06-28 00:44:07 +02:00
parent f328e00027
commit 187db7e6f5

View File

@@ -369,33 +369,28 @@ public final class SQLiteConnector implements
@Override @Override
public void clearTXData() { public void clearTXData() {
flushTable("transactions"); runDeletionQuery("DELETE FROM transactions;");
} }
@Override @Override
public void clearOfferData() { public void clearOfferData() {
flushTable("offers"); runDeletionQuery("DELETE FROM offers;");
} }
@Override @Override
public void clearProductData() { public void clearProductData() {
flushTable("products"); runDeletionQuery("DELETE FROM products;");
} }
/** /**
* Flushes all data from the specified table. * Flushes all data using the specified query.
* *
* @param table * @param query
*/ */
private void flushTable(final String table) { private void runDeletionQuery(final String query) {
try (Connection connection = db.getConnection(); try (Connection connection = db.getConnection();
Statement statement = connection.createStatement()) { Statement statement = connection.createStatement()) {
if (table.matches("[\\w]+")) {
String query = "DELETE FROM " + table + ";";
statement.executeUpdate(query); statement.executeUpdate(query);
} else {
throw new PersistenceException("Table name contains illegal characters");
}
} catch (SQLException e) { } catch (SQLException e) {
throw new PersistenceException("Something went wrong while clearing the database", e); throw new PersistenceException("Something went wrong while clearing the database", e);
} }