From 0b5b6e7db23634c2cf727439ce524c931d574122 Mon Sep 17 00:00:00 2001 From: Christian Ehrlicher Date: Mon, 26 Feb 2024 15:18:39 +0100 Subject: [PATCH] SQL/ODBC: escape values in connection string Values in connection strings must be escaped when they - contain a ; -> escape with " - start with ' -> escape with " - start with " -> escape with ' Fixes: QTBUG-122642 Change-Id: I1df638194067af5df94a34009e1547886fdf928c Reviewed-by: Axel Spoerl Reviewed-by: Thiago Macieira (cherry picked from commit 000d462bf93b21a9bbb46fdba631c09ba3eb9276) Reviewed-by: Qt Cherry-pick Bot --- src/plugins/sqldrivers/odbc/qsql_odbc.cpp | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/src/plugins/sqldrivers/odbc/qsql_odbc.cpp b/src/plugins/sqldrivers/odbc/qsql_odbc.cpp index 1d4abe1fb99..cde56459c4a 100644 --- a/src/plugins/sqldrivers/odbc/qsql_odbc.cpp +++ b/src/plugins/sqldrivers/odbc/qsql_odbc.cpp @@ -1918,6 +1918,18 @@ bool QODBCDriver::open(const QString & db, int, const QString& connOpts) { + const auto ensureEscaped = [](QString arg) -> QString { + QChar quoteChar; + if (arg.startsWith(u'"')) + quoteChar = u'\''; + else if (arg.startsWith(u'\'')) + quoteChar = u'"'; + else if (arg.contains(u';')) + quoteChar = u'"'; + else + return arg; + return quoteChar + arg + quoteChar; + }; Q_D(QODBCDriver); if (isOpen()) close(); @@ -1953,17 +1965,17 @@ bool QODBCDriver::open(const QString & db, QString connQStr; // support the "DRIVER={SQL SERVER};SERVER=blah" syntax if (db.contains(".dsn"_L1, Qt::CaseInsensitive)) - connQStr = "FILEDSN="_L1 + db; + connQStr = "FILEDSN="_L1 + ensureEscaped(db); else if (db.contains("DRIVER="_L1, Qt::CaseInsensitive) || db.contains("SERVER="_L1, Qt::CaseInsensitive)) - connQStr = db; + connQStr = ensureEscaped(db); else - connQStr = "DSN="_L1 + db; + connQStr = "DSN="_L1 + ensureEscaped(db); if (!user.isEmpty()) - connQStr += ";UID="_L1 + user; + connQStr += ";UID="_L1 + ensureEscaped(user); if (!password.isEmpty()) - connQStr += ";PWD="_L1 + password; + connQStr += ";PWD="_L1 + ensureEscaped(password); SQLSMALLINT cb; QVarLengthArray connOut(1024);