Skip to content

Commit 27e648b

Browse files
committed
separate stream handling from statement
1 parent d685640 commit 27e648b

File tree

1 file changed

+28
-27
lines changed

1 file changed

+28
-27
lines changed

persistence/relational-jdbc/src/main/java/org/apache/polaris/persistence/relational/jdbc/DatasourceOperations.java

Lines changed: 28 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -82,37 +82,38 @@ DatabaseType getDatabaseType() {
8282
* @throws SQLException : Exception while executing the script.
8383
*/
8484
public void executeScript(InputStream scriptInputStream) throws SQLException {
85-
runWithinTransaction(
86-
connection -> {
87-
try (Statement statement = connection.createStatement();
88-
BufferedReader reader =
89-
new BufferedReader(
90-
new InputStreamReader(Objects.requireNonNull(scriptInputStream), UTF_8))) {
91-
StringBuilder sqlBuffer = new StringBuilder();
92-
String line;
93-
while ((line = reader.readLine()) != null) {
94-
line = line.trim();
95-
if (!line.isEmpty() && !line.startsWith("--")) { // Ignore empty lines and comments
96-
sqlBuffer.append(line).append("\n");
97-
if (line.endsWith(";")) { // Execute statement when semicolon is found
98-
String sql = sqlBuffer.toString().trim();
99-
try {
100-
// since SQL is directly read from the file, there is close to 0 possibility
101-
// of this being injected plus this run via an Admin tool, if attacker can
102-
// fiddle with this that means lot of other things are already compromised.
103-
statement.execute(sql);
104-
} catch (SQLException e) {
105-
throw new RuntimeException(e);
85+
try (BufferedReader scriptReader =
86+
new BufferedReader(
87+
new InputStreamReader(Objects.requireNonNull(scriptInputStream), UTF_8))) {
88+
List<String> scriptLines = scriptReader.lines().toList();
89+
runWithinTransaction(
90+
connection -> {
91+
try (Statement statement = connection.createStatement()) {
92+
StringBuilder sqlBuffer = new StringBuilder();
93+
for (String line : scriptLines) {
94+
line = line.trim();
95+
if (!line.isEmpty() && !line.startsWith("--")) { // Ignore empty lines and comments
96+
sqlBuffer.append(line).append("\n");
97+
if (line.endsWith(";")) { // Execute statement when semicolon is found
98+
String sql = sqlBuffer.toString().trim();
99+
try {
100+
// since SQL is directly read from the file, there is close to 0 possibility
101+
// of this being injected plus this run via an Admin tool, if attacker can
102+
// fiddle with this that means lot of other things are already compromised.
103+
statement.execute(sql);
104+
} catch (SQLException e) {
105+
throw new RuntimeException(e);
106+
}
107+
sqlBuffer.setLength(0); // Clear the buffer for the next statement
106108
}
107-
sqlBuffer.setLength(0); // Clear the buffer for the next statement
108109
}
109110
}
111+
return true;
110112
}
111-
return true;
112-
} catch (IOException e) {
113-
throw new RuntimeException(e);
114-
}
115-
});
113+
});
114+
} catch (IOException e) {
115+
throw new RuntimeException(e);
116+
}
116117
}
117118

118119
/**

0 commit comments

Comments
 (0)