3888 database dump escape (#3906)

* Add target argument to address specific db. Add escape of command line parameters where it is necessary. Replace double quotes with single quotes. Improve the code standards * Replace translation string for restore db command
hechoendrupal · Apr 6, 2019 · 7103912 · 7103912
1 parent 9cff0df
commit 7103912
Show file tree

Hide file tree

Showing 10 changed files with 100 additions and 66 deletions.
diff --git a/src/Command/Database/ClientCommand.php b/src/Command/Database/ClientCommand.php
@@ -32,6 +32,12 @@ protected function configure()
                 $this->trans('commands.database.client.arguments.database'),
                 'default'
             )
+            ->addArgument(
+                'target',
+                InputArgument::OPTIONAL,
+                $this->trans('commands.database.client.arguments.target'),
+                'default'
+            )
             ->setHelp($this->trans('commands.database.client.help'))
             ->setAliases(['dbc']);
     }
@@ -43,18 +49,10 @@ protected function execute(InputInterface $input, OutputInterface $output)
     {
         $database = $input->getArgument('database');
         $learning = $input->getOption('learning');
+        $target = $input->getArgument('target');
 
-        $databaseConnection = $this->resolveConnection($database);
-
-        $connection = sprintf(
-            '%s --database=%s --user=%s --password=%s --host=%s --port=%s',
-            $databaseConnection['driver'],
-            $databaseConnection['database'],
-            $databaseConnection['username'],
-            $databaseConnection['password'],
-            $databaseConnection['host'],
-            $databaseConnection['port']
-        );
+        $databaseConnection = $this->resolveConnection($database, $target);
+        $connection = $this->getConnectionString($databaseConnection);
 
         if ($learning) {
             $this->getIo()->commentBlock(

diff --git a/src/Command/Database/ConnectCommand.php b/src/Command/Database/ConnectCommand.php
@@ -50,20 +50,10 @@ protected function execute(InputInterface $input, OutputInterface $output)
         $target = $input->getArgument('target');
         $databaseConnection = $this->resolveConnection($key, $target);
 
-        $connection = sprintf(
-            '%s -A --database=%s --user=%s --password=%s --host=%s --port=%s',
-            $databaseConnection['driver'],
-            $databaseConnection['database'],
-            $databaseConnection['username'],
-            $databaseConnection['password'],
-            $databaseConnection['host'],
-            $databaseConnection['port']
-        );
-
         $this->getIo()->commentBlock(
             sprintf(
                 $this->trans('commands.database.connect.messages.connection'),
-                $connection
+                escapeshellcmd($this->getConnectionString($databaseConnection))
             )
         );
 

diff --git a/src/Command/Database/DumpCommand.php b/src/Command/Database/DumpCommand.php
@@ -55,6 +55,12 @@ protected function configure()
                 $this->trans('commands.database.dump.arguments.database'),
                 'default'
             )
+            ->addArgument(
+                'target',
+                InputArgument::OPTIONAL,
+                $this->trans('commands.database.dump.arguments.target'),
+                'default'
+            )
             ->addOption(
                 'file',
                 null,
@@ -77,11 +83,12 @@ protected function configure()
     protected function execute(InputInterface $input, OutputInterface $output)
     {
         $database = $input->getArgument('database');
+        $target = $input->getArgument('target');
         $file = $input->getOption('file');
         $learning = $input->getOption('learning');
         $gz = $input->getOption('gz');
 
-        $databaseConnection = $this->resolveConnection($database);
+        $databaseConnection = $this->escapeConnection($this->resolveConnection($database, $target));
 
         if (!$file) {
             $date = new \DateTime();
@@ -125,7 +132,7 @@ protected function execute(InputInterface $input, OutputInterface $output)
             $resultFile = $file;
             if ($gz) {
                 if (substr($file, -3) != '.gz') {
-                    $resultFile = $file . ".gz";
+                    $resultFile = $file . '.gz';
                 }
                 file_put_contents(
                     $resultFile,

diff --git a/src/Command/Database/QueryCommand.php b/src/Command/Database/QueryCommand.php
@@ -43,6 +43,12 @@ protected function configure()
                 $this->trans('commands.database.query.arguments.database'),
                 'default'
             )
+            ->addArgument(
+                'target',
+                InputArgument::OPTIONAL,
+                $this->trans('commands.database.connect.arguments.target'),
+                'default'
+            )
             ->addOption('quick', null, InputOption::VALUE_NONE, $this->trans('commands.database.query.options.quick'))
             ->addOption('debug', null, InputOption::VALUE_NONE, $this->trans('commands.database.query.options.debug'))
             ->addOption('html', null, InputOption::VALUE_NONE, $this->trans('commands.database.query.options.html'))
@@ -62,9 +68,10 @@ protected function execute(InputInterface $input, OutputInterface $output)
     {
         $query = $input->getArgument('query');
         $database = $input->getArgument('database');
+        $target = $input->getArgument('target');
         $learning = $input->getOption('learning');
 
-        $databaseConnection = $this->resolveConnection($database);
+        $databaseConnection = $this->resolveConnection($database, $target);
 
         $connection = sprintf(
             '%s -A --database=%s --user=%s --password=%s --host=%s --port=%s',
@@ -79,31 +86,31 @@ protected function execute(InputInterface $input, OutputInterface $output)
         $args = explode(' ', $connection);
         $args[] = sprintf('--execute=%s', $query);
 
-        $opts = ["quick", "debug", "html", "xml", "raw", "vertical", "batch"];
+        $opts = ['quick', 'debug', 'html', 'xml', 'raw', 'vertical', 'batch'];
         array_walk(
             $opts, function ($opt) use ($input, &$args) {
                 if ($input->getOption($opt)) {
                     switch ($opt) {
-                    case "quick":
-                        $args[] = "--quick";
+                    case 'quick':
+                        $args[] = '--quick';
                         break;
-                    case "debug":
-                        $args[] = "-T";
+                    case 'debug':
+                        $args[] = '-T';
                         break;
-                    case "html":
-                        $args[] = "-H";
+                    case 'html':
+                        $args[] = '-H';
                         break;
-                    case "xml":
-                        $args[] = "-X";
+                    case 'xml':
+                        $args[] = '-X';
                         break;
-                    case "raw":
-                        $args[] = "--raw";
+                    case 'raw':
+                        $args[] = '--raw';
                         break;
-                    case "vertical":
-                        $args[] = "-E";
+                    case 'vertical':
+                        $args[] = '-E';
                         break;
-                    case "batch":
-                        $args[] = "--batch";
+                    case 'batch':
+                        $args[] = '--batch';
                         break;
                     }
                 }
@@ -112,11 +119,11 @@ protected function execute(InputInterface $input, OutputInterface $output)
 
         if ($learning) {
             $this->getIo()->commentBlock(
-                implode(" ", $args)
+                implode(' ', $args)
             );
         }
 
-        $processBuilder = new ProcessBuilder([]);
+        $processBuilder = new ProcessBuilder();
         $processBuilder->setArguments($args);
         $process = $processBuilder->getProcess();
         $process->setTty('true');

diff --git a/src/Command/Database/RestoreCommand.php b/src/Command/Database/RestoreCommand.php
@@ -49,6 +49,12 @@ protected function configure()
                 $this->trans('commands.database.restore.arguments.database'),
                 'default'
             )
+            ->addArgument(
+                'target',
+                InputArgument::OPTIONAL,
+                $this->trans('commands.database.restore.arguments.target'),
+                'default'
+            )
             ->addOption(
                 'file',
                 null,
@@ -66,11 +72,11 @@ protected function configure()
     protected function execute(InputInterface $input, OutputInterface $output)
     {
         $database = $input->getArgument('database');
+        $target = $input->getArgument('target');
         $file = $input->getOption('file');
         $learning = $input->getOption('learning');
 
-        $databaseConnection = $this->resolveConnection($database);
-
+        $databaseConnection = $this->escapeConnection($this->resolveConnection($database, $target));
         if (!$file) {
             $this->getIo()->error(
                 $this->trans('commands.database.restore.messages.no-file')
@@ -82,25 +88,27 @@ protected function execute(InputInterface $input, OutputInterface $output)
         } else {
             $catCommand = 'cat %s | ';
         }
+
+        $command = NULL;
         if ($databaseConnection['driver'] == 'mysql') {
             $command = sprintf(
-                $catCommand . 'mysql --user=%s --password=%s --host=%s --port=%s %s',
-                $file,
-                $databaseConnection['username'],
-                $databaseConnection['password'],
-                $databaseConnection['host'],
-                $databaseConnection['port'],
-                $databaseConnection['database']
+              $catCommand . 'mysql --user=%s --password=%s --host=%s --port=%s %s',
+              $file,
+              $databaseConnection['username'],
+              $databaseConnection['password'],
+              $databaseConnection['host'],
+              $databaseConnection['port'],
+              $databaseConnection['database']
             );
         } elseif ($databaseConnection['driver'] == 'pgsql') {
             $command = sprintf(
-                $catCommand . 'PGPASSWORD="%s" psql -w -U %s -h %s -p %s -d %s',
-                $file,
-                $databaseConnection['password'],
-                $databaseConnection['username'],
-                $databaseConnection['host'],
-                $databaseConnection['port'],
-                $databaseConnection['database']
+              $catCommand . 'PGPASSWORD="%s" psql -w -U %s -h %s -p %s -d %s',
+              $file,
+              $databaseConnection['password'],
+              $databaseConnection['username'],
+              $databaseConnection['host'],
+              $databaseConnection['port'],
+              $databaseConnection['database']
             );
         }
 

diff --git a/src/Command/Debug/DatabaseTableCommand.php b/src/Command/Debug/DatabaseTableCommand.php
@@ -77,7 +77,7 @@ protected function execute(InputInterface $input, OutputInterface $output)
         $databaseConnection = $this->resolveConnection($database);
         if ($table) {
             $result = $this->database
-                ->query('DESCRIBE '. $table .';')
+                ->query('DESCRIBE ' . $table . ';')
                 ->fetchAll();
             if (!$result) {
                 throw new \Exception(

diff --git a/src/Command/Module/DownloadCommand.php b/src/Command/Module/DownloadCommand.php
@@ -225,7 +225,7 @@ protected function execute(InputInterface $input, OutputInterface $output)
                 }
 
                 // Register composer repository
-                $command = "composer config repositories.drupal composer https://packages.drupal.org/8";
+                $command = 'composer config repositories.drupal composer https://packages.drupal.org/8';
                 $this->shellProcess->exec($command, $this->root);
 
                 $command = sprintf(

diff --git a/src/Command/Module/InstallCommand.php b/src/Command/Module/InstallCommand.php
@@ -160,7 +160,7 @@ protected function execute(InputInterface $input, OutputInterface $output)
 
                 $processBuilder = new ProcessBuilder([]);
                 $processBuilder->setWorkingDirectory($this->appRoot);
-                $processBuilder->setArguments(explode(" ", $command));
+                $processBuilder->setArguments(explode(' ', $command));
                 $process = $processBuilder->getProcess();
                 $process->setTty('true');
                 $process->run();

diff --git a/src/Command/Module/UpdateCommand.php b/src/Command/Module/UpdateCommand.php
@@ -112,20 +112,20 @@ protected function execute(InputInterface $input, OutputInterface $output)
         }
 
         if (count($modules) > 1) {
-            $modules = " drupal/" . implode(" drupal/", $modules);
+            $modules = ' drupal/' . implode(' drupal/', $modules);
         } else {
-            $modules = " drupal/" . current($modules);
+            $modules = ' drupal/' . current($modules);
         }
 
         if ($composer) {
             // Register composer repository
-            $command = "composer config repositories.drupal composer https://packages.drupal.org/8";
+            $command = 'composer config repositories.drupal composer https://packages.drupal.org/8';
             $this->shellProcess->exec($command, $this->root);
 
             $command = 'composer update ' . $modules . ' --optimize-autoloader --prefer-dist --no-dev --root-reqs ';
 
             if ($simulate) {
-                $command .= " --dry-run";
+                $command .= ' --dry-run';
             }
 
             if ($this->shellProcess->exec($command, $this->root)) {

diff --git a/src/Command/Shared/ConnectTrait.php b/src/Command/Shared/ConnectTrait.php
@@ -66,4 +66,28 @@ public function getRedBeanConnection($database = 'default')
 
         return null;
     }
-}
+
+    public function getConnectionString($databaseConnection) {
+        return sprintf(
+          '%s -A --database=%s --user=%s --password=%s --host=%s --port=%s',
+          $databaseConnection['driver'],
+          $databaseConnection['database'],
+          $databaseConnection['username'],
+          $databaseConnection['password'],
+          $databaseConnection['host'],
+          $databaseConnection['port']
+        );
+    }
+
+    public function escapeConnection($databaseConnection) {
+        $settings = [
+          'driver', 'database', 'username', 'password', 'host', 'port'
+        ];
+
+        foreach ($settings as $setting) {
+            $databaseConnection[$setting] = escapeshellcmd($databaseConnection[$setting]);
+        }
+
+        return $databaseConnection;
+    }
+}