Joseph Doherty
4dc2ad8084
Until now ISqlDialect.QuoteIdentifier was the SOLE defence for authored
table/column names: an identifier went from the TagConfig blob straight into a
command text, bracket-quoted. The residual risk was bounded — a hostile name is
quoted into one nonexistent object, the query fails after the connection opens,
and the tag Bad-codes — but "bounded" is not "filtered", and the design promised
a filter. Both ISqlDialect and SqlServerDialect carried a doc paragraph saying so.
SqlCatalogGate + SqlCatalogLoader now resolve every authored identifier against
the live catalog at Initialize, and REPLACE it with the catalog's own spelling.
The identifier text in an emitted poll query is therefore a string this driver
read back out of ListSchemas/ListTables/ListColumns — not operator input. Quoting
becomes the backstop it was documented to be.
Decisions worth knowing before touching this:
- Substitution, not just validation. Matching is exact-ordinal first, then a
UNIQUE case-insensitive hit: SQL Server's default collation is CI so case
variants have always worked, and rejecting them would break valid deployments.
An ambiguous CI match under a case-sensitive collation is refused rather than
guessed — picking one would publish another column's data under the operator's
node, which is worse than rejecting the tag.
- Charset check BEFORE catalog lookup. Each identifier goes through
QuoteIdentifier for its rejection rules first, so a name carrying a control or
Unicode format character is rejected WITHOUT its value being echoed into a log
line (Trojan-Source). A name that passes is safe to render, which is why
catalog-miss messages do name it — an operator hunting a typo has to see what
they wrote. Both halves are pinned by tests.
- A rejected tag keeps its node. It is dropped from the POLLED table but stays in
the AUTHORED table, so it still materializes and reads BadNodeIdUnknown —
§8.1's specified outcome. My first wiring dropped it from both, which deleted
the node instead; an existing test (ReinitializeAsync_recoversFromFaulted)
caught it. A status code can only be published by a node that exists, and a
missing address-space entry is far harder to diagnose than a Bad quality.
- An unreadable catalog FAULTS Initialize; it does not reject every tag. That is
the absence of evidence about the tags, not evidence against them — rejecting
all of them would serve a confidently-empty address space and send the operator
hunting typos that do not exist. Zero visible schemas is treated the same way,
because that is exactly what a missing GRANT looks like. Faulting lands
DriverInstanceActor in Reconnecting with its retry timer running.
- Bounded load: one schema list, one default-schema scalar, then one ListTables
per distinct authored schema and one ListColumns per distinct authored relation
— never a full catalog enumeration, and nothing after Initialize. Every
authored name reaches the catalog queries as a bound @schema/@table parameter,
so building the allow-list cannot itself be an injection vector.
- ISqlDialect gains DefaultSchemaSql ("SELECT SCHEMA_NAME()"). An unqualified
`TagValues` must resolve in whatever schema the SERVER reports; hardcoding dbo
would be a silent lie on any estate that maps service accounts to their own
default schema. It is a query, not a constant, because the answer is
per-connection.
- Accepted v1 limitation: a 3-part db.schema.table (or linked-server name)
addresses a catalog this connection cannot enumerate, so it cannot be
allow-listed and is rejected with a message pointing at the fix — expose the
data through a view in the connected database.
VerifyLivenessAsync's wall-clock pattern is extracted to RunBoundedAsync and
reused, so the new I/O gets the same R2-01 / STAB-14 protection rather than a
second hand-rolled copy. (It also fixes a latent bug in the extracted code: the
OperationCanceledException arm detached the wrong task.)
Tests: 24 pure gate tests + 9 end-to-end driver tests against the real SQLite
catalog + 3 new live tests against the real SQL Server on 10.100.0.35 (21 in that
suite now pass, exercising the real SELECT SCHEMA_NAME() + INFORMATION_SCHEMA
path). Verified falsifiable: bypassing the gate turns exactly the three rejection
assertions red and leaves the rest green.
SqlInjectionRegressionTests is deliberately NOT rewritten to expect
BadNodeIdUnknown. It drives SqlPollReader directly, below the gate, and pins the
quoting backstop on its own — defence in depth is only worth the name if each
layer holds independently. Rewriting those assertions would delete the backstop's
only coverage and leave the gate a single point of failure. Its scope note, which
said the gate does not exist, is updated to say why it stays where it is.
124 lines
8.4 KiB
C#
124 lines
8.4 KiB
C#
using System.Data.Common;
|
|
using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
|
|
using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
|
|
|
|
/// <summary>
|
|
/// The provider seam (design §2.2). ADO.NET's <see cref="System.Data.Common"/> base types abstract
|
|
/// connections, commands, parameters and readers; they do <b>not</b> abstract the three things that differ
|
|
/// per backend — <b>identifier quoting</b>, the <b>metadata-catalog SQL</b>, and <b>row-limit syntax</b>.
|
|
/// Those live here, so no dialect assumption leaks into the reader, the poll planner, or the schema browser.
|
|
/// <para><b>This interface is the driver's SQL-injection boundary.</b> Every runtime <em>value</em> is
|
|
/// bound as a <see cref="DbParameter"/> and never reaches a command text. Identifiers cannot be
|
|
/// parameterized in SQL, so the few that must appear as text are emitted through
|
|
/// <see cref="QuoteIdentifier"/>. Any code path that builds SQL by concatenating an authored tag field
|
|
/// <em>without</em> going through <see cref="QuoteIdentifier"/> is a defect (design §8.1).</para>
|
|
/// <para><b>Quoting is the backstop, not the only defence.</b> Design §8.1's catalog gate is
|
|
/// implemented: <see cref="SqlCatalogGate"/> resolves every authored table/column against the live
|
|
/// catalog at Initialize and <b>replaces it with the catalog's own spelling</b>, so an identifier
|
|
/// reaching <see cref="QuoteIdentifier"/> on the poll path is a string this driver read back out of
|
|
/// <see cref="ListSchemasSql"/> / <see cref="ListTablesSql"/> / <see cref="ListColumnsSql"/> — not
|
|
/// operator input. An identifier that resolves to nothing rejects its tag (which then publishes
|
|
/// <c>BadNodeIdUnknown</c>) rather than being quoted into a query against a nonexistent object.</para>
|
|
/// <para>Public because <c>Driver.Sql.Browser</c> consumes it — the catalog SQL <em>is</em> the browse
|
|
/// engine, so it is shared rather than duplicated. Implementations own their provider package;
|
|
/// <b>no provider-specific type appears in this signature</b> (<see cref="Factory"/> is the abstract
|
|
/// <see cref="DbProviderFactory"/>).</para>
|
|
/// </summary>
|
|
public interface ISqlDialect
|
|
{
|
|
/// <summary>Which backend this dialect speaks. v1 constructs <see cref="SqlProvider.SqlServer"/> only.</summary>
|
|
SqlProvider Provider { get; }
|
|
|
|
/// <summary>
|
|
/// The provider's factory singleton, used to create connections/commands/parameters. Deliberately the
|
|
/// abstract base type so consumers never bind to a concrete provider package.
|
|
/// </summary>
|
|
DbProviderFactory Factory { get; }
|
|
|
|
/// <summary>
|
|
/// Quotes <b>one</b> identifier part so it can be safely embedded in a command text, escaping the
|
|
/// dialect's own quote character. Rejects anything that cannot be a real catalog identifier rather
|
|
/// than emitting it.
|
|
/// <para><b>One part only.</b> A multi-part name such as <c>dbo.TagValues</c> must be split by the
|
|
/// caller and each part quoted separately; passing the dotted form yields a single (nonexistent)
|
|
/// identifier — safe, but not what the caller meant.</para>
|
|
/// </summary>
|
|
/// <param name="ident">The bare, unquoted identifier — as returned by the catalog, not pre-quoted.</param>
|
|
/// <returns>The quoted identifier, ready to concatenate into a command text.</returns>
|
|
/// <exception cref="ArgumentException">The value cannot be a valid catalog identifier.</exception>
|
|
string QuoteIdentifier(string ident);
|
|
|
|
/// <summary>Cheapest statement that proves the connection is alive (<c>SELECT 1</c>; Oracle needs <c>FROM DUAL</c>).</summary>
|
|
string LivenessSql { get; }
|
|
|
|
/// <summary>
|
|
/// The fragment that goes <b>immediately after <c>SELECT</c></b> to limit a statement to one row —
|
|
/// T-SQL's <c>"TOP 1 "</c>. Empty for a dialect that spells the limit at the end of the statement (see
|
|
/// <see cref="SingleRowLimitSuffix"/>).
|
|
/// <para><b>Include the trailing space</b> when non-empty: the planner concatenates
|
|
/// <c>"SELECT " + SingleRowLimitPrefix + columns</c> with no separator of its own, so an empty fragment
|
|
/// must leave the statement byte-identical to an unlimited one.</para>
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// <para><b>Why a prefix/suffix pair rather than one <c>ApplyRowLimit(sql, n)</c> method.</b> The two
|
|
/// spellings sit at opposite ends of the statement — SQL Server writes
|
|
/// <c>SELECT TOP 1 … ORDER BY … DESC</c>, while SQLite/Postgres/MySQL write
|
|
/// <c>SELECT … ORDER BY … DESC LIMIT 1</c>. A single method taking the SELECT list could only serve the
|
|
/// prefix position; a single method taking the whole statement would move statement assembly out of the
|
|
/// planner and into every dialect. Two fragments keep the planner the sole author of statement shape
|
|
/// and let each dialect fill in the end it uses.</para>
|
|
/// <para><b>Why "single row" rather than a row count.</b> The only limit v1 emits is the wide-row
|
|
/// <c>topByTimestamp</c> selector's newest-row pick. Modelling an arbitrary <c>n</c> would be untested
|
|
/// surface, and <c>FETCH FIRST</c>/<c>ROWNUM</c> dialects need more than a substituted number anyway.
|
|
/// Widen this to a method when a feature actually needs <c>n > 1</c>.</para>
|
|
/// </remarks>
|
|
string SingleRowLimitPrefix { get; }
|
|
|
|
/// <summary>
|
|
/// The fragment appended to the <b>very end</b> of a statement to limit it to one row —
|
|
/// <c>" LIMIT 1"</c> for SQLite/Postgres/MySQL. Empty for a dialect that limits after <c>SELECT</c>
|
|
/// (see <see cref="SingleRowLimitPrefix"/>).
|
|
/// <para><b>Include the leading space</b> when non-empty, for the same reason the prefix carries a
|
|
/// trailing one: the planner appends it directly to the finished statement.</para>
|
|
/// <para>Exactly one of the two fragments is non-empty in every dialect modelled so far, but the planner
|
|
/// emits <b>both</b> unconditionally — a dialect needing both ends (or neither) is expressible without
|
|
/// touching the call site.</para>
|
|
/// </summary>
|
|
string SingleRowLimitSuffix { get; }
|
|
|
|
/// <summary>Catalog query listing schemas — the browser's <c>RootAsync</c> level. Takes no parameters.</summary>
|
|
string ListSchemasSql { get; }
|
|
|
|
/// <summary>
|
|
/// Scalar query returning the schema an <b>unqualified</b> object name resolves to for the connecting
|
|
/// principal — T-SQL's <c>SELECT SCHEMA_NAME()</c>. Takes no parameters.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// <para>Needed by <see cref="SqlCatalogGate"/>: a tag authored as <c>TagValues</c> rather than
|
|
/// <c>dbo.TagValues</c> has to be looked up in <em>some</em> schema, and guessing <c>dbo</c> would be a
|
|
/// silent lie on any estate that maps its service accounts to their own default schema. Asking the
|
|
/// server is the only answer that matches how the poll query itself will resolve the name.</para>
|
|
/// <para>It is a <em>query</em> rather than a name because the answer is per-connection, not per-dialect
|
|
/// — the same dialect resolves differently for two different logins.</para>
|
|
/// </remarks>
|
|
string DefaultSchemaSql { get; }
|
|
|
|
/// <summary>Catalog query listing tables + views in one schema — the browser's schema-expand level. Bind <c>@schema</c>.</summary>
|
|
string ListTablesSql { get; }
|
|
|
|
/// <summary>Catalog query listing columns of one table — the browser's table-expand / attributes level. Bind <c>@schema</c> and <c>@table</c>.</summary>
|
|
string ListColumnsSql { get; }
|
|
|
|
/// <summary>
|
|
/// Folds a catalog data-type family name (as <c>INFORMATION_SCHEMA.COLUMNS.DATA_TYPE</c> reports it —
|
|
/// e.g. <c>nvarchar</c>, never <c>nvarchar(50)</c>) onto a <see cref="DriverDataType"/>.
|
|
/// <para>Must <b>never throw</b>: a browse over a table holding one exotic column must still render.
|
|
/// An unrecognised family falls back to <see cref="DriverDataType.String"/>.</para>
|
|
/// </summary>
|
|
/// <param name="sqlDataType">The bare SQL type family name; matched case-insensitively.</param>
|
|
/// <returns>The mapped driver data type, or <see cref="DriverDataType.String"/> when unrecognised.</returns>
|
|
DriverDataType MapColumnType(string sqlDataType);
|
|
}
|