1

Several times I've found myself refactoring web application code and end up wanting to do something like this (Groovy in this case, but could be anything):

Map getData(String relationName, Integer rowId) {
    def sql = Sql.newInstance([...])
    def result = sql.firstRow('SELECT getRelationRow(?,?)', relationName, rowId)
    sql.close()
    return new HashMap(result)
}

where the stored procedure getRelationRow(relname text, rowid integer) executes dynamic sql to retrieve the row of the specified rowid in the requested relation. The best example I've seen of such a function is this polymorphic function using anyelement type, and is called as

SELECT * FROM data_of(NULL::pcdmet, 17);

However to call this in the above code would require

def result = sql.firstRow("SELECT * FROM data_of(NULL::${relationName},?)",  rowId)

that is, it required the relation name to be pasted into the query, which risks SQL Injection. So is there away to keep the polymorphic goodness of the stored procedure but allow it to be called with generic relation names?

1

1 Answer 1

1

I don't think it can be done this way. I assume Groovy is using prepared statements here, which requires that input and return types are known at prepare time, while my function derives the return type from the polymorphic input type.

I am pretty sure you need string concatenation. But don't fret, there are functions like pg_escape() to sanitize table names and make SQLi impossible. Don't know Groovy, but it should have that, too.

Or does it?

Based on the function data_of(..) at the end of this related answer:

With PREPARE I can make this work by declaring the return type explicitly:

PREPARE fooplan ("relationName") AS  -- table name works as row type
SELECT * FROM data_of($1, $2);

Then I can hand in NULL, which is cast to "relationName" from the prepared context:

EXECUTE fooplan(NULL, 1);

So this might work after all, if your interface supports this. But you still have to concatenate the table name as return data type (and therefore defend against SQLi). Catch 22 I guess.

4
  • Ah well, figured you'd know if anyone did. I always feel a bit dubious of escaping strings, but yes that's probably the way to go. So far I've resorted to JSON to have a constant return type.
    – beldaz
    Feb 18, 2015 at 4:36
  • @beldaz: I am only half an expert here, since I don't know Groovy. But if it's prepared statements, then I am afraid you have to concatenate one way or the other. I added another idea. Feb 18, 2015 at 4:56
  • Yes it's prepared statements, more to dissociate the parameters from the query than for any other benefits. Interesting idea about using PREPARE. Not sure I have access to it in the languages I typically use (Groovy/JDBC, Java/JDBC or PHP/PDO) but worth a look.
    – beldaz
    Feb 18, 2015 at 5:02
  • @ErwinBrandstetter - I've posted a question as a follow-up at stackoverflow.com/q/75487149/584940. I'm curious on what your thoughts might be.
    – Randall
    Feb 21, 2023 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.