Mirrors/inspec
2
0
Fork 0
mirror of https://github.com/inspec/inspec synced 2025-02-17 06:28:40 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fixed MssqlSession.query not escaping double quote correctly

Browse source 
When `MssqlSession.query` is escaping the `"` character, it is doing so by prefixing it with a backslash (e.g. `\"`). This does not escape the quote character. It should be escaped by adding an additional double quote character (e.g. `""`).
This commit is contained in:
dalee-bis 2019-08-15 11:28:50 +01:00 • committed by GitHub
parent 8e62048b97
commit 7f2dbd918f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/inspec/resources/mssql_session.rb
View file

@ -53,7 +53,7 @@ module Inspec::Resources
end
def query(q) # rubocop:disable Metrics/PerceivedComplexity
escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '""').gsub(/\$/, '\\$')
# surpress 'x rows affected' in SQLCMD with 'set nocount on;'
cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
cmd_string += " -U '#{@user}' -P '#{@password}'" unless @user.nil? || @password.nil?