Doctrine Project

[DBAL-120] MySql platform getAlterTableSQL does not quote existing column names

Duplicate — Sun, 19 Jun 2011 09:46:39 +0000

When creating alter table SQL, the MySqlPlatform class does not quote names for columns of an existing table when building a CHANGE query. This can cause SQL errors.

It creates queries like this:

ALTER TABLE my_table CHANGE key `key` INTVARCHAR(255) DEFAULT '' NOT NULL';

Attached is a patch to fix this.

As an aside, is this the best way to contribute a patch? Or is a GitHub pull request better?

[DBAL-111] MySQL Driver possibly subject to sql injections with PDO::quote()

Sat, 14 May 2011 07:24:48 +0000

Prior to 5.3.6, the MySQL PDO driver ignored the character set parameter to options. Due to MySQL's C api (and MySQLND), this is required for the proper function of mysql_real_escape_string() (the C API call). Since PDO uses the mres() C call for PDO::quote(), this means that the quoted string does not take into account the connection character set.

Starting with 5.3.6, that was fixed. So now if you pass the proper character set to PDO via driver options, sql injection is impossible while using the PDO::quote() api call.

PDO proof of concept

$dsn = 'mysql:dbname=INFORMATION_SCHEMA;host=127.0.0.1;charset=GBK;';
$pdo = new PDO($dsn, $user, $pass);
$pdo->exec('SET NAMES GBK');
$string = chr(0xbf) . chr(0x27) . ' OR 1 = 1; /*';
$sql = "SELECT TABLE_NAME
            FROM INFORMATION_SCHEMA.TABLES
            WHERE TABLE_NAME LIKE ".$pdo->quote($string)." LIMIT 1;";
$stmt = $pdo->query($sql);
var_dump($stmt->rowCount());

Expected Result: `int(0)`.
Actual Result: `int(1)`.

There are 2 issues to fix. First, the documentation does not indicate that you can pass the `charset` option to the MySQL Driver. This should be fixed so that users are given the proper option to set character sets.

Secondly, `Connection::setCharset()` should be modified for MySQL to throw an exception, since the character set is only safely setable using the DSN with PDO. This is a limitation of the driver and could be asked as a feature request for the PHP core. Either that, or a big warning should be put on the documentation of the API to indicate the unsafe character set change

[DBAL-106] Doctrine\DBAL\Schema\Comparator false positives

Wed, 6 Apr 2011 17:19:17 +0000

I am using the model class annotations for my Doctrine schema definition and a MySQL database for my target. When testing code that uses Doctrine\DBAL\Schema\Comparator, either by using $schemaTool->updateSchema($classes) which is defined in the core functionality or by running doctrine migrations:diff from the Doctrine Migrations project, a set of bugs are revealed. The symptoms of this are that immediately after calling $schemaTool->createSchema($classes) any call that uses the Comparator class to calculate the diffs between the real database and the schema definition produce a large set of false positives. Most of these false positives can be traced back to the logic in Doctrine\DBAL\Schema\Comparator::diffColumn(Column $column1, Column $column2). There are two issues here I can see right away:

One is that if the model annotations rely on defaults rather than explicitly defining certain attributes, this function sees them as different. For example, if I have a column defined like this: @Column(type="decimal", scale=2, nullable=true) then the Comparator believes it is different from the real database because precision is 10 in the real data and 0 in my schema. If I change the line to this: if (($column1->getPrecision() ?: 10) != ($column2->getPrecision() ?: 10)) then it works, but I am sure a real solution needs to determine what the defaults actually are.

The second issue is when I use the 'columnDefinition' attribute with a custom type to declare an enum or set, for instance. Since this function does not actually check what the columnDefinition field is set to at all, it has no way to know if I have actually made a change to the list of values, or anything else about that columnDefinition. I have been reading that using the comments field might be another way to do this, but I am not yet clear on what the best practice really is here. I know that http://www.doctrine-project.org/jira/browse/DBAL-42 touches on this with regard to storing Array type metadata in the comments field. I need more direction on how this should work in custom field types.

In addition, I am getting this strange set of diffs on the index for a ManyToMany association's join table:

        $this->addSql("CREATE INDEX IDX_44B8C6D89AF7860 ON firm_firm (firm_id)");
        $this->addSql("DROP INDEX primary ON firm_firm");
        $this->addSql("CREATE UNIQUE INDEX primary ON firm_firm (firm_id, firm_id)");

I am not sure why this only happens on this one table and not others, but it seems to be another case of the Comparator getting a false positive for some reason this time in Comparator::diffIndex(Index $index1, Index $index2). The model annotations for this association are:

  /**
   * @var Firm
   * @ManyToMany(targetEntity="Firm")
   */
  protected $Children = array();

I will add more to this as I learn more details about the issues, but hopefully this is enough to start grokking the issues in Comparator. Getting the Comparator class in the core Doctrine\DBAL library working properly for calculating diffs will go a long way toward making well defined migrations a reality for Doctrine2 projects running in production. Hopefully, someone will also be able to address this minor issue in the Doctrine Migrations (http://www.doctrine-project.org/jira/browse/DMIG-21) so that it can be deployed without needing a patch.

Thanks to everyone for Doctrine2, and I am looking forward to being among the first to put this new library into production on a real world project in a few months.

[DBAL-101] Undefined index "length" in SqliteSchemaManager

Wed, 6 Apr 2011 15:19:05 +0000

If not giving length for numeric columns when using SQLite, I got an undefined index error around line 155 in SqliteSchemaManager. I fixed it with this:

             case 'numeric':
-                list($precision, $scale) = array_map('trim', explode(', ', $tableColumn['length']));
+                if (array_key_exists('length', $tableColumn)) {
+                    list($precision, $scale) = array_map('trim', explode(', ', $tableColumn['length']));
+                } else {
+                    $precision = $scale = null;
+                }
                 $length = null;
                 break;

Git patch attached.

[DBAL-105] Schema Comparator produces invalid SQL

Wed, 6 Apr 2011 14:21:17 +0000

Before:

/**
 * @orm:Entity
 * @orm:Table(name="twitter_users")
 */
class TwitterUser implements UserInterface
{
    const ROLE_DEFAULT = 'ROLE_TWITTER_USER';

    /**
     * @orm:Id
     * @orm:GeneratedValue(strategy="AUTO")
     * @orm:Column(type="integer")
     */
    private $id;

    /**
     * @orm:Column(type="integer", unique=true, nullable=false)
     */
    private $twitterId;

    /**
     * @orm:Column(type="string", unique=true, nullable=false)
     */
    private $displayName;
}

After:

/**
 * @orm:Entity
 * @orm:Table(name="twitter_users")
 */
class TwitterUser implements UserInterface
{
    const ROLE_DEFAULT = 'ROLE_TWITTER_USER';

    /**
     * @orm:Id
     * @orm:GeneratedValue(strategy="AUTO")
     * @orm:Column(type="integer")
     */
    private $id;

    /**
     * @orm:Column(type="integer", unique=true, nullable=false, name="twitter_id")
     */
    private $twitterId;

    /**
     * @orm:Column(type="string", unique=true, nullable=false, name="display_name")
     */
    private $displayName;

    /**
     * @orm:Column(type="datetime", name="last_logged_in_at", nullable=true)
     */
    private $lastLoggedInAt;
}

Bugs in the generated SQL:

last_logged_in_at column is not added
displayName is dropped, and at the same time the column name "displayName" is changed to "display_name"
twitterId same as above