Skip to content

Commit 0b683cc

Browse files
benrr101benrr101
committed
Merge _rpcForEncryption, BuildStoredProcedureStatementForColumnEncryption
1 parent db8b2e7 commit 0b683cc

5 files changed

Lines changed: 140 additions & 236 deletions

File tree

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SqlCommand.netcore.cs‎

Lines changed: 0 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ public sealed partial class SqlCommand : DbCommand, ICloneable
3333
internal static readonly Action<object> s_cancelIgnoreFailure = CancelIgnoreFailureCallback;
3434

3535
private _SqlRPC[] _rpcArrayOf1 = null; // Used for RPC executes
36-
private _SqlRPC _rpcForEncryption = null; // Used for sp_describe_parameter_encryption RPC executes
3736

3837
// cut down on object creation and cache all these
3938
// cached metadata
@@ -1332,123 +1331,6 @@ private static int GetParameterCount(SqlParameterCollection parameters)
13321331
return parameters != null ? parameters.Count : 0;
13331332
}
13341333

1335-
/// <summary>
1336-
/// This function constructs a string parameter containing the exec statement in the following format
1337-
/// N'EXEC sp_name @param1=@param1, @param1=@param2, ..., @paramN=@paramN'
1338-
/// TODO: Need to handle return values.
1339-
/// </summary>
1340-
/// <param name="storedProcedureName">Stored procedure name</param>
1341-
/// <param name="parameters">SqlParameter list</param>
1342-
/// <returns>A string SqlParameter containing the constructed sql statement value</returns>
1343-
private SqlParameter BuildStoredProcedureStatementForColumnEncryption(string storedProcedureName, SqlParameterCollection parameters)
1344-
{
1345-
Debug.Assert(CommandType == CommandType.StoredProcedure, "BuildStoredProcedureStatementForColumnEncryption() should only be called for stored procedures");
1346-
Debug.Assert(!string.IsNullOrWhiteSpace(storedProcedureName), "storedProcedureName cannot be null or empty in BuildStoredProcedureStatementForColumnEncryption");
1347-
1348-
StringBuilder execStatement = new StringBuilder();
1349-
execStatement.Append(@"EXEC ");
1350-
1351-
if (parameters is null)
1352-
{
1353-
execStatement.Append(ParseAndQuoteIdentifier(storedProcedureName, false));
1354-
return new SqlParameter(
1355-
null,
1356-
((execStatement.Length << 1) <= TdsEnums.TYPE_SIZE_LIMIT) ? SqlDbType.NVarChar : SqlDbType.NText,
1357-
execStatement.Length)
1358-
{
1359-
Value = execStatement.ToString()
1360-
};
1361-
}
1362-
1363-
// Find the return value parameter (if any).
1364-
SqlParameter returnValueParameter = null;
1365-
foreach (SqlParameter param in parameters)
1366-
{
1367-
if (param.Direction == ParameterDirection.ReturnValue)
1368-
{
1369-
returnValueParameter = param;
1370-
break;
1371-
}
1372-
}
1373-
1374-
// If there is a return value parameter we need to assign the result to it.
1375-
// EXEC @returnValue = moduleName [parameters]
1376-
if (returnValueParameter != null)
1377-
{
1378-
SqlParameter.AppendPrefixedParameterName(execStatement, returnValueParameter.ParameterName);
1379-
execStatement.Append('=');
1380-
}
1381-
1382-
execStatement.Append(ParseAndQuoteIdentifier(storedProcedureName, false));
1383-
1384-
// Build parameter list in the format
1385-
// @param1=@param1, @param1=@param2, ..., @paramn=@paramn
1386-
1387-
// Append the first parameter
1388-
int index = 0;
1389-
int count = parameters.Count;
1390-
SqlParameter parameter;
1391-
if (count > 0)
1392-
{
1393-
// Skip the return value parameters.
1394-
while (index < parameters.Count && parameters[index].Direction == ParameterDirection.ReturnValue)
1395-
{
1396-
index++;
1397-
}
1398-
1399-
if (index < count)
1400-
{
1401-
parameter = parameters[index];
1402-
// Possibility of a SQL Injection issue through parameter names and how to construct valid identifier for parameters.
1403-
// Since the parameters comes from application itself, there should not be a security vulnerability.
1404-
// Also since the query is not executed, but only analyzed there is no possibility for elevation of privilege, but only for
1405-
// incorrect results which would only affect the user that attempts the injection.
1406-
execStatement.Append(' ');
1407-
SqlParameter.AppendPrefixedParameterName(execStatement, parameter.ParameterName);
1408-
execStatement.Append('=');
1409-
SqlParameter.AppendPrefixedParameterName(execStatement, parameter.ParameterName);
1410-
1411-
// InputOutput and Output parameters need to be marked as such.
1412-
if (parameter.Direction == ParameterDirection.Output ||
1413-
parameter.Direction == ParameterDirection.InputOutput)
1414-
{
1415-
execStatement.AppendFormat(@" OUTPUT");
1416-
}
1417-
}
1418-
}
1419-
1420-
// Move to the next parameter.
1421-
index++;
1422-
1423-
// Append the rest of parameters
1424-
for (; index < count; index++)
1425-
{
1426-
parameter = parameters[index];
1427-
if (parameter.Direction != ParameterDirection.ReturnValue)
1428-
{
1429-
execStatement.Append(", ");
1430-
SqlParameter.AppendPrefixedParameterName(execStatement, parameter.ParameterName);
1431-
execStatement.Append('=');
1432-
SqlParameter.AppendPrefixedParameterName(execStatement, parameter.ParameterName);
1433-
1434-
// InputOutput and Output parameters need to be marked as such.
1435-
if (
1436-
parameter.Direction == ParameterDirection.Output ||
1437-
parameter.Direction == ParameterDirection.InputOutput
1438-
)
1439-
{
1440-
execStatement.AppendFormat(@" OUTPUT");
1441-
}
1442-
}
1443-
}
1444-
1445-
// Construct @tsql SqlParameter to be returned
1446-
SqlParameter tsqlParameter = new SqlParameter(null, ((execStatement.Length << 1) <= TdsEnums.TYPE_SIZE_LIMIT) ? SqlDbType.NVarChar : SqlDbType.NText, execStatement.Length);
1447-
tsqlParameter.Value = execStatement.ToString();
1448-
1449-
return tsqlParameter;
1450-
}
1451-
14521334
// paramList parameter for sp_executesql, sp_prepare, and sp_prepexec
14531335
internal string BuildParamList(TdsParser parser, SqlParameterCollection parameters, bool includeReturnValue = false)
14541336
{

‎src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/SqlCommand.netfx.cs‎

Lines changed: 0 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ public sealed partial class SqlCommand : DbCommand, ICloneable
3131
internal static readonly Action<object> s_cancelIgnoreFailure = CancelIgnoreFailureCallback;
3232

3333
private _SqlRPC[] _rpcArrayOf1 = null; // Used for RPC executes
34-
private _SqlRPC _rpcForEncryption = null; // Used for sp_describe_parameter_encryption RPC executes
3534

3635
// cut down on object creation and cache all these
3736
// cached metadata
@@ -1340,123 +1339,6 @@ private static int GetParameterCount(SqlParameterCollection parameters)
13401339
return parameters != null ? parameters.Count : 0;
13411340
}
13421341

1343-
/// <summary>
1344-
/// This function constructs a string parameter containing the exec statement in the following format
1345-
/// N'EXEC sp_name @param1=@param1, @param1=@param2, ..., @paramN=@paramN'
1346-
/// TODO: Need to handle return values.
1347-
/// </summary>
1348-
/// <param name="storedProcedureName">Stored procedure name</param>
1349-
/// <param name="parameters">SqlParameter list</param>
1350-
/// <returns>A string SqlParameter containing the constructed sql statement value</returns>
1351-
private SqlParameter BuildStoredProcedureStatementForColumnEncryption(string storedProcedureName, SqlParameterCollection parameters)
1352-
{
1353-
Debug.Assert(CommandType == CommandType.StoredProcedure, "BuildStoredProcedureStatementForColumnEncryption() should only be called for stored procedures");
1354-
Debug.Assert(!string.IsNullOrWhiteSpace(storedProcedureName), "storedProcedureName cannot be null or empty in BuildStoredProcedureStatementForColumnEncryption");
1355-
1356-
StringBuilder execStatement = new StringBuilder();
1357-
execStatement.Append(@"EXEC ");
1358-
1359-
if (parameters is null)
1360-
{
1361-
execStatement.Append(ParseAndQuoteIdentifier(storedProcedureName, false));
1362-
return new SqlParameter(
1363-
null,
1364-
((execStatement.Length << 1) <= TdsEnums.TYPE_SIZE_LIMIT) ? SqlDbType.NVarChar : SqlDbType.NText,
1365-
execStatement.Length)
1366-
{
1367-
Value = execStatement.ToString()
1368-
};
1369-
}
1370-
1371-
// Find the return value parameter (if any).
1372-
SqlParameter returnValueParameter = null;
1373-
foreach (SqlParameter param in parameters)
1374-
{
1375-
if (param.Direction == ParameterDirection.ReturnValue)
1376-
{
1377-
returnValueParameter = param;
1378-
break;
1379-
}
1380-
}
1381-
1382-
// If there is a return value parameter we need to assign the result to it.
1383-
// EXEC @returnValue = moduleName [parameters]
1384-
if (returnValueParameter != null)
1385-
{
1386-
SqlParameter.AppendPrefixedParameterName(execStatement, returnValueParameter.ParameterName);
1387-
execStatement.Append('=');
1388-
}
1389-
1390-
execStatement.Append(ParseAndQuoteIdentifier(storedProcedureName, false));
1391-
1392-
// Build parameter list in the format
1393-
// @param1=@param1, @param1=@param2, ..., @paramn=@paramn
1394-
1395-
// Append the first parameter
1396-
int index = 0;
1397-
int count = parameters.Count;
1398-
SqlParameter parameter;
1399-
if (count > 0)
1400-
{
1401-
// Skip the return value parameters.
1402-
while (index < parameters.Count && parameters[index].Direction == ParameterDirection.ReturnValue)
1403-
{
1404-
index++;
1405-
}
1406-
1407-
if (index < count)
1408-
{
1409-
parameter = parameters[index];
1410-
// Possibility of a SQL Injection issue through parameter names and how to construct valid identifier for parameters.
1411-
// Since the parameters comes from application itself, there should not be a security vulnerability.
1412-
// Also since the query is not executed, but only analyzed there is no possibility for elevation of privilege, but only for
1413-
// incorrect results which would only affect the user that attempts the injection.
1414-
execStatement.Append(' ');
1415-
SqlParameter.AppendPrefixedParameterName(execStatement, parameter.ParameterName);
1416-
execStatement.Append('=');
1417-
SqlParameter.AppendPrefixedParameterName(execStatement, parameter.ParameterName);
1418-
1419-
// InputOutput and Output parameters need to be marked as such.
1420-
if (parameter.Direction == ParameterDirection.Output ||
1421-
parameter.Direction == ParameterDirection.InputOutput)
1422-
{
1423-
execStatement.AppendFormat(@" OUTPUT");
1424-
}
1425-
}
1426-
}
1427-
1428-
// Move to the next parameter.
1429-
index++;
1430-
1431-
// Append the rest of parameters
1432-
for (; index < count; index++)
1433-
{
1434-
parameter = parameters[index];
1435-
if (parameter.Direction != ParameterDirection.ReturnValue)
1436-
{
1437-
execStatement.Append(", ");
1438-
SqlParameter.AppendPrefixedParameterName(execStatement, parameter.ParameterName);
1439-
execStatement.Append('=');
1440-
SqlParameter.AppendPrefixedParameterName(execStatement, parameter.ParameterName);
1441-
1442-
// InputOutput and Output parameters need to be marked as such.
1443-
if (
1444-
parameter.Direction == ParameterDirection.Output ||
1445-
parameter.Direction == ParameterDirection.InputOutput
1446-
)
1447-
{
1448-
execStatement.AppendFormat(@" OUTPUT");
1449-
}
1450-
}
1451-
}
1452-
1453-
// Construct @tsql SqlParameter to be returned
1454-
SqlParameter tsqlParameter = new SqlParameter(null, ((execStatement.Length << 1) <= TdsEnums.TYPE_SIZE_LIMIT) ? SqlDbType.NVarChar : SqlDbType.NText, execStatement.Length);
1455-
tsqlParameter.Value = execStatement.ToString();
1456-
1457-
return tsqlParameter;
1458-
}
1459-
14601342
// paramList parameter for sp_executesql, sp_prepare, and sp_prepexec
14611343
internal string BuildParamList(TdsParser parser, SqlParameterCollection parameters, bool includeReturnValue = false)
14621344
{

0 commit comments

Comments
 (0)