ebean-orm#3209 MetricsAsJson escape the SQL string content

FOCONIS · Oct 10, 2023 · 23870a7 · 23870a7
1 parent ee17ab5
commit 23870a7
Show file tree

Hide file tree

Showing 2 changed files with 37 additions and 1 deletion.
diff --git a/ebean-api/src/main/java/io/ebean/meta/MetricsAsJson.java b/ebean-api/src/main/java/io/ebean/meta/MetricsAsJson.java
@@ -187,11 +187,22 @@ private void logQuery(MetaQueryMetric metric) throws IOException {
     }
     if (isIncludeDetail(metric)) {
       append("loc", metric.location());
-      append("sql", metric.sql());
+      append("sql", escape(metric.sql()));
     }
     metricEnd();
   }
 
+  static String escape(String sql) {
+    return sql == null ? null : sql
+      .replace("\\", "\\\\")
+      .replace("\"", "\\\"")
+      .replace("\b", "\\b")
+      .replace("\f", "\\f")
+      .replace("\n", "\\n")
+      .replace("\r", "\\r")
+      .replace("\t", "\\t");
+  }
+
   private boolean isIncludeDetail(MetaTimedMetric metric) {
     return includeExtraAttributes == 2 || includeExtraAttributes == 1 && metric.initialCollection();
   }

diff --git a/ebean-api/src/test/java/io/ebean/meta/MetricsAsJsonTest.java b/ebean-api/src/test/java/io/ebean/meta/MetricsAsJsonTest.java
@@ -0,0 +1,25 @@
+package io.ebean.meta;
+
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class MetricsAsJsonTest {
+
+  @Test
+  void trimIt() {
+    assertThat(MetricsAsJson.escape(null)).isNull();
+    assertThat(MetricsAsJson.escape("abc")).isEqualTo("abc");
+  }
+
+  @Test
+  void escape() {
+    assertThat(MetricsAsJson.escape("a\"bc")).isEqualTo("a\\\"bc");
+    assertThat(MetricsAsJson.escape("a\tbc")).isEqualTo("a\\tbc");
+    assertThat(MetricsAsJson.escape("a\bbc")).isEqualTo("a\\bbc");
+    assertThat(MetricsAsJson.escape("a\bc")).isEqualTo("a\\bc");
+    assertThat(MetricsAsJson.escape("a\rbc")).isEqualTo("a\\rbc");
+    assertThat(MetricsAsJson.escape("a\nbc")).isEqualTo("a\\nbc");
+    assertThat(MetricsAsJson.escape("a\\bc")).isEqualTo("a\\\\bc");
+  }
+}