Changeset 102793 in webkit

Timestamp:

Dec 14, 2011 9:48:26 AM (12 years ago)

Author:

vsevik@chromium.org

Message:

Web Inspector: DatabaseTableView should escape table name.
​https://bugs.webkit.org/show_bug.cgi?id=74503

Reviewed by Pavel Feldman.

Source/WebCore:

Test: inspector/database-table-name-excaping.html

• inspector/front-end/DatabaseTableView.js:

(WebInspector.DatabaseTableView.prototype._escapeTableName):
(WebInspector.DatabaseTableView.prototype.update):

LayoutTests:

• inspector/database-table-name-excaping-expected.txt: Added.
• inspector/database-table-name-excaping.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/inspector/database-table-name-excaping-expected.txt (added)
• LayoutTests/inspector/database-table-name-excaping.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/inspector/front-end/DatabaseTableView.js (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-12-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: DatabaseTableView should escape table name.
+        https://bugs.webkit.org/show_bug.cgi?id=74503
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/database-table-name-excaping-expected.txt: Added.
+        * inspector/database-table-name-excaping.html: Added.
+
 2011-12-14  João Paulo Rechi Vita  <jprvita@openbossa.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-12-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: DatabaseTableView should escape table name.
+        https://bugs.webkit.org/show_bug.cgi?id=74503
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/database-table-name-excaping.html
+
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._escapeTableName):
+        (WebInspector.DatabaseTableView.prototype.update):
+
 2011-12-14  Philippe Normand  <pnormand@igalia.com>
 

trunk/Source/WebCore/inspector/front-end/DatabaseTableView.js

@@ -53 +53 @@
     },
 
+    /**
+     * @param {string} tableName
+     * @return {string}
+     */
+    _escapeTableName: function(tableName)
+    {
+        return tableName.replace(/\"/g, "\"\"");
+    },
+    
     update: function()
     {
-        this.database.executeSql("SELECT * FROM " + this.tableName, this._queryFinished.bind(this), this._queryError.bind(this));
+        this.database.executeSql("SELECT * FROM \"" + this._escapeTableName(this.tableName) + "\"", this._queryFinished.bind(this), this._queryError.bind(this));
     },