Patched potential security risk
This commit is contained in:
@@ -369,33 +369,28 @@ public final class SQLiteConnector implements
|
||||
|
||||
@Override
|
||||
public void clearTXData() {
|
||||
flushTable("transactions");
|
||||
runDeletionQuery("DELETE FROM transactions;");
|
||||
}
|
||||
|
||||
@Override
|
||||
public void clearOfferData() {
|
||||
flushTable("offers");
|
||||
runDeletionQuery("DELETE FROM offers;");
|
||||
}
|
||||
|
||||
@Override
|
||||
public void clearProductData() {
|
||||
flushTable("products");
|
||||
runDeletionQuery("DELETE FROM products;");
|
||||
}
|
||||
|
||||
/**
|
||||
* Flushes all data from the specified table.
|
||||
* Flushes all data using the specified query.
|
||||
*
|
||||
* @param table
|
||||
* @param query
|
||||
*/
|
||||
private void flushTable(final String table) {
|
||||
private void runDeletionQuery(final String query) {
|
||||
try (Connection connection = db.getConnection();
|
||||
Statement statement = connection.createStatement()) {
|
||||
if (table.matches("[\\w]+")) {
|
||||
String query = "DELETE FROM " + table + ";";
|
||||
statement.executeUpdate(query);
|
||||
} else {
|
||||
throw new PersistenceException("Table name contains illegal characters");
|
||||
}
|
||||
} catch (SQLException e) {
|
||||
throw new PersistenceException("Something went wrong while clearing the database", e);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user