Merge pull request #100 from christianhelle/copilot/resolve-sonarcloud-issues

Fix SonarCloud critical issues: thread safety, memory safety, and SQL injection

Author: christianhelle

.gitignore

@@ -64,3 +64,4 @@ src/project/linux/translations
 *.snap
 .vs
 src/main.cpp
+*.csv

_codeql_detected_source_root

@@ -0,0 +1 @@
+.

src/database/dbanalyzer.cpp

@@ -27,7 +27,10 @@ void DbAnalyzer::loadTables(DatabaseInfo &info) const {
     }
 
     QSqlQuery query(this->database->getDatabase());
-    query.exec(sql);
+    if (!query.exec(sql)) {
+        database->close();
+        return;
+    }
 
     while (query.next()) {
         Table table;
@@ -47,10 +50,12 @@ void DbAnalyzer::loadColumns(DatabaseInfo &info) const {
     }
 
     for (auto &table: info.tables) {
-        const QString sql = "PRAGMA table_info (" + table.name + ")";
+        const QString sql = "PRAGMA table_info (\"" + table.name + "\")";
 
         QSqlQuery query(this->database->getDatabase());
-        query.exec(sql);
+        if (!query.exec(sql)) {
+            continue;
+        }
 
         while (query.next()) {
             Column col;

src/database/dbexportdata.cpp

@@ -56,11 +56,13 @@ void DbDataExport::exportDataToSqlFile(const Database *database,
 
         QSqlQuery query(database->getDatabase());
         query.setForwardOnly(true);
-        query.exec(QString("SELECT * FROM %1").arg(table.name));
+        if (!query.exec(QString("SELECT * FROM \"%1\"").arg(table.name))) {
+            continue;
+        }
         const auto columns = getColumnDefs(table).join(", ");
         while (query.next() && !cancellationToken->isCancellationRequested()) {
             const auto values = getColumnValueDefs(table, query).join(", ");
-            out << "INSERT INTO " << table.name << "(" << columns << ") ";
+            out << "INSERT INTO \"" << table.name << "\"(" << columns << ") ";
             out << "VALUES (" << values << ");\n";
             progress->increment();
         }
@@ -94,7 +96,10 @@ void DbDataExport::exportDataToCsvFile(const Database *database,
 
         QSqlQuery query(database->getDatabase());
         query.setForwardOnly(true);
-        query.exec(QString("SELECT * FROM %1").arg(table.name));
+        if (!query.exec(QString("SELECT * FROM \"%1\"").arg(table.name))) {
+            file->close();
+            continue;
+        }
 
         while (query.next() && !cancellationToken->isCancellationRequested()) {
             const auto values = getColumnValueDefs(table, query).join(delimiter);

src/database/dbquery.cpp

@@ -30,8 +30,8 @@ void DbQuery::clearResults() {
         if (model != Q_NULLPTR) {
             model->clear();
         }
-        table->setModel(Q_NULLPTR);
         delete model;
+        table->setModel(Q_NULLPTR);
     }
     qDeleteAll(this->tableResults.begin(), this->tableResults.end());
     this->tableResults.clear();

src/gui/mainwindow.cpp

@@ -226,7 +226,11 @@ void MainWindow::loadRecentFiles() const {
 }
 
 void MainWindow::openRecentFile() {
-    const QString file = sender()->objectName();
+    auto *senderObject = sender();
+    if (senderObject == nullptr) {
+        return;
+    }
+    const QString file = senderObject->objectName();
     this->openDatabase(file);
 }
 

src/gui/prompts.cpp

@@ -7,16 +7,16 @@
 #include "../settings/settings.h"
 
 QString Prompts::getCsvDelimiter(QWidget *parent,
-                                 [[maybe_unused]] const QString &defaultDelimiter = ",") {
+                                 const QString &defaultDelimiter) {
     bool ok{};
     auto input = QInputDialog::getText(parent,
-                                       "CSV Delimeter",
-                                       "Please enter delimeter to use",
+                                       "CSV Delimiter",
+                                       "Please enter delimiter to use",
                                        QLineEdit::Normal,
-                                       ",",
+                                       defaultDelimiter,
                                        &ok);
     if (!ok || input.isEmpty()) {
-        input = ",";
+        input = defaultDelimiter;
     }
     return input;
 }
@@ -25,7 +25,7 @@ QString Prompts::getFolderPath(QWidget *parent) {
     SessionState state;
     Settings::getSessionState(&state);
     auto directory = state.lastUsedExportPath;
-    if (state.lastUsedExportPath == Q_NULLPTR || state.lastUsedExportPath.isEmpty()) {
+    if (state.lastUsedExportPath.isEmpty()) {
         directory = QDir::home().absolutePath();
     }
 
@@ -41,7 +41,7 @@ QString Prompts::getFilePath(QWidget *parent,
     SessionState state;
     Settings::getSessionState(&state);
     auto directory = state.lastUsedExportPath;
-    if (state.lastUsedExportPath == Q_NULLPTR || state.lastUsedExportPath.isEmpty()) {
+    if (state.lastUsedExportPath.isEmpty()) {
         directory = QDir::home().absolutePath();
     }
 
@@ -60,7 +60,7 @@ QString Prompts::getFilePath(QWidget *parent,
         }
     }
 
-    return Q_NULLPTR;
+    return QString();
 }
 
 bool Prompts::confirmDelete(QWidget *parent, const QString &tableName) {

src/threading/cancellation.cpp

@@ -1,16 +1,16 @@
 #include "cancellation.h"
 
-CancellationToken::CancellationToken(bool *isCancelled): isCancelled(isCancelled) {
+CancellationToken::CancellationToken(std::atomic<bool> *isCancelled): isCancelled(isCancelled) {
 }
 
 bool CancellationToken::isCancellationRequested() const {
-    return *isCancelled;
+    return isCancelled->load();
 }
 
 CancellationToken CancellationTokenSource::get() {
     return CancellationToken(&isCancelled);
 }
 
 void CancellationTokenSource::cancel() {
-    isCancelled = true;
+    isCancelled.store(true);
 }

src/threading/cancellation.h

@@ -1,15 +1,16 @@
 #ifndef CANCELLATION_H
 #define CANCELLATION_H
 
+#include <atomic>
 
 class CancellationToken {
 public:
-    explicit CancellationToken(bool *isCancelled);
+    explicit CancellationToken(std::atomic<bool> *isCancelled);
 
     [[nodiscard]] bool isCancellationRequested() const;
 
 private:
-    bool *isCancelled = nullptr;
+    std::atomic<bool> *isCancelled = nullptr;
 };
 
 class CancellationTokenSource {
@@ -19,7 +20,7 @@ class CancellationTokenSource {
     void cancel();
 
 private:
-    bool isCancelled = false;
+    std::atomic<bool> isCancelled{false};
 };