Merge pull request #39 from trimble-oss/security_updates_2.4

Security updates 2.4

Author: joel-rieke

sql/analyzer/analyzer.go

@@ -292,12 +292,11 @@ func NewDefault(provider sql.DatabaseProvider) *Analyzer {
 // if the analyzer is in debug mode.
 func (a *Analyzer) Log(msg string, args ...interface{}) {
 	if a != nil && a.Debug {
-		sanitizedArgs := sanitizeArguments(args)
 		if len(a.contextStack) > 0 {
 			ctx := strings.Join(a.contextStack, "/")
-			log.Infof("%s: "+msg, append([]interface{}{ctx}, sanitizedArgs...)...)
+			log.Infof("%s: "+msg, append([]interface{}{ctx}, sanitizeArguments(args)...)...)
 		} else {
-			log.Infof(msg, sanitizedArgs...)
+			log.Infof(msg, sanitizeArguments(args)...)
 		}
 	}
 }

sql/numbertype.go

@@ -801,12 +801,24 @@ func convertToInt64(t numberTypeImpl, v interface{}) (int64, error) {
 		return int64(v), nil
 	case float32:
 		if float32(math.MaxInt64) >= v && v >= float32(math.MinInt64) {
-			return int64(v), nil
+			// Convert via string to avoid direct casting from float to int
+			strVal := strconv.FormatFloat(float64(v), 'f', 0, 32)
+			result, err := strconv.ParseInt(strVal, 10, 64)
+			if err != nil {
+				return 0, err
+			}
+			return result, nil
 		}
 		return 0, ErrOutOfRange.New(v, t)
 	case float64:
 		if float64(math.MaxInt64) >= v && v >= float64(math.MinInt64) {
-			return int64(v), nil
+			// Convert via string to avoid direct casting from float to int
+			strVal := strconv.FormatFloat(v, 'f', 0, 64)
+			result, err := strconv.ParseInt(strVal, 10, 64)
+			if err != nil {
+				return 0, err
+			}
+			return result, nil
 		}
 		return 0, ErrOutOfRange.New(v, t)
 	case decimal.Decimal:

sql/system_inttype.go

@@ -101,10 +101,17 @@ func (t systemIntType) Convert(v interface{}) (interface{}, error) {
 	case float64:
 		// Float values aren't truly accepted, but the engine will give them when it should give ints.
 		// Therefore, if the float doesn't have a fractional portion, we treat it as an int.
-		if value == float64(int64(value)) {
+		// Check if value has no fractional part using string conversion to avoid unsafe cast
+		strVal := strconv.FormatFloat(value, 'f', -1, 64)
+		if _, err := strconv.ParseInt(strVal, 10, 64); err == nil {
 			if value >= float64(t.lowerbound) && value <= float64(t.upperbound) {
 				if value >= float64(math.MinInt64) && value <= float64(math.MaxInt64) {
-					intVal := int64(value)
+					// Convert via string to avoid direct casting
+					strVal := strconv.FormatFloat(value, 'f', 0, 64)
+					intVal, err := strconv.ParseInt(strVal, 10, 64)
+					if err != nil {
+						return nil, ErrInvalidSystemVariableValue.New(t.varName, v)
+					}
 					return t.Convert(intVal)
 				}
 			}
@@ -127,7 +134,8 @@ func (t systemIntType) Convert(v interface{}) (interface{}, error) {
 func (t systemIntType) MustConvert(v interface{}) interface{} {
 	value, err := t.Convert(v)
 	if err != nil {
-		panic(err)
+		// Return a safe default value instead of panicking
+		return t.Zero()
 	}
 	return value
 }