dk-remove_comment_sql_injection_validation

lib/postgrex.ex

@@ -67,10 +67,6 @@ defmodule Postgrex do
   @max_rows 500
   @timeout 15_000
 
-  @comment_validation_error Postgrex.Error.exception(
-                              message: "`:comment` option cannot contain sequence \"*/\""
-                            )
-
   ### PUBLIC API ###
 
   @doc """
@@ -332,15 +328,9 @@ defmodule Postgrex do
 
   defp comment_not_present!(opts) do
     case Keyword.get(opts, :comment) do
-      nil ->
-        true
-
-      comment when is_binary(comment) ->
-        if String.contains?(comment, "*/") do
-          raise @comment_validation_error
-        else
-          false
-        end
+      nil -> true
+      comment when is_binary(comment) -> false
+      comment when is_list(comment) -> false
     end
   end
 

lib/postgrex/protocol.ex

@@ -1603,7 +1603,7 @@ defmodule Postgrex.Protocol do
   end
 
   defp parse_describe_comment_msgs(query, comment, tail) when is_binary(comment) do
-    statement = [query.statement, "/*", comment, "*/"]
+    statement = [query.statement, ";/*", comment, "*/"]
     query = %{query | statement: statement}
     parse_describe_msgs(query, tail)
   end

test/query_test.exs

@@ -1851,12 +1851,18 @@ defmodule QueryTest do
     assert [["1", "2"], ["3", "4"]] = query("COPY (VALUES (1, 2), (3, 4)) TO STDOUT", [], opts)
   end
 
-  test "comment", context do
+  test "comment is not interfering with the query", context do
+    assert [[123]] = query("select 123", [], comment: ["query", "comment" | ["goes here"]])
     assert [[123]] = query("select 123", [], comment: "query comment goes here")
+    assert [[123]] = query("select 123;", [], comment: "query comment goes here")
+  end
 
-    assert_raise Postgrex.Error, fn ->
-      query("select 123", [], comment: "*/ DROP TABLE 123 --")
-    end
+  test "comment does not allow for sql injection", context do
+    %Postgrex.Error{postgres: error} = query("select 123", [], comment: "*/ select 456 --")
+    assert error.message =~ "cannot insert multiple commands into a prepared statement"
+
+    %Postgrex.Error{postgres: error} = query("select 123", [], comment: "*/ where false --")
+    assert error.message =~ ~s'syntax error at or near "where"'
   end
 
   @tag :big_binary