@@ -82,37 +82,38 @@ DatabaseType getDatabaseType() {
8282 * @throws SQLException : Exception while executing the script.
8383 */
8484 public void executeScript (InputStream scriptInputStream ) throws SQLException {
85- runWithinTransaction (
86- connection -> {
87- try (Statement statement = connection .createStatement ();
88- BufferedReader reader =
89- new BufferedReader (
90- new InputStreamReader (Objects .requireNonNull (scriptInputStream ), UTF_8 ))) {
91- StringBuilder sqlBuffer = new StringBuilder ();
92- String line ;
93- while ((line = reader .readLine ()) != null ) {
94- line = line .trim ();
95- if (!line .isEmpty () && !line .startsWith ("--" )) { // Ignore empty lines and comments
96- sqlBuffer .append (line ).append ("\n " );
97- if (line .endsWith (";" )) { // Execute statement when semicolon is found
98- String sql = sqlBuffer .toString ().trim ();
99- try {
100- // since SQL is directly read from the file, there is close to 0 possibility
101- // of this being injected plus this run via an Admin tool, if attacker can
102- // fiddle with this that means lot of other things are already compromised.
103- statement .execute (sql );
104- } catch (SQLException e ) {
105- throw new RuntimeException (e );
85+ try (BufferedReader scriptReader =
86+ new BufferedReader (
87+ new InputStreamReader (Objects .requireNonNull (scriptInputStream ), UTF_8 ))) {
88+ List <String > scriptLines = scriptReader .lines ().toList ();
89+ runWithinTransaction (
90+ connection -> {
91+ try (Statement statement = connection .createStatement ()) {
92+ StringBuilder sqlBuffer = new StringBuilder ();
93+ for (String line : scriptLines ) {
94+ line = line .trim ();
95+ if (!line .isEmpty () && !line .startsWith ("--" )) { // Ignore empty lines and comments
96+ sqlBuffer .append (line ).append ("\n " );
97+ if (line .endsWith (";" )) { // Execute statement when semicolon is found
98+ String sql = sqlBuffer .toString ().trim ();
99+ try {
100+ // since SQL is directly read from the file, there is close to 0 possibility
101+ // of this being injected plus this run via an Admin tool, if attacker can
102+ // fiddle with this that means lot of other things are already compromised.
103+ statement .execute (sql );
104+ } catch (SQLException e ) {
105+ throw new RuntimeException (e );
106+ }
107+ sqlBuffer .setLength (0 ); // Clear the buffer for the next statement
106108 }
107- sqlBuffer .setLength (0 ); // Clear the buffer for the next statement
108109 }
109110 }
111+ return true ;
110112 }
111- return true ;
112- } catch (IOException e ) {
113- throw new RuntimeException (e );
114- }
115- });
113+ });
114+ } catch (IOException e ) {
115+ throw new RuntimeException (e );
116+ }
116117 }
117118
118119 /**
0 commit comments