MigsLab SDKARX.SDK documentation
Ctrl K

PostgreSQL · Types · Other public types

ArxInjectionCheck

Definition

Namespace
ARX.SDK.Providers
Package
ARX.SDK
C#
public static class ArxInjectionCheck

The rule every provider uses to tell a name that looks like an SQL injection attempt (ARX1017 SuspectedInjection) from a plain invalid name (ARX1003 InvalidIdentifier).

Properties

  • const int MAX_ECHO_LENGTH

    The longest part of a suspicious name an error message repeats.

Methods

  • static string? Inspect(string? name)

    What makes name look like an injection attempt (for example contains ';' or contains the SQL word 'UNION'), or null when it doesn't (a space alone, a leading digit or a long name is a plain invalid name).

    Parameter Type Description
    namestring?The name that failed the identifier rules, as the caller gave it.
  • static string Echo(string? name)

    name made safe to put in a message or a log line: control characters and line breaks escaped (so the name can't forge log lines), and cut to MAX_ECHO_LENGTH characters.

    Parameter Type Description
    namestring?The name to quote in a message.
  • static ArxValidationException Refuse(string kind, string? name, string evidence, string? provider = null)

    The ARX1017 error for a kind name ("Entity", "Attribute", "Type", …) that Inspect found suspicious, with evidence as returned by it. Providers raise this, so the message is the same everywhere.

    Parameter Type Description
    kindstringWhat the name is, for the message: "Entity", "Attribute", "Type" and so on.
    namestring?The suspicious name, quoted safely in the message.
    evidencestringWhat Inspect found in it.
    providerstring?= nullThe provider's name for Provider, or null.

Notes

A provider calls Inspect only for a name that has already failed its identifier rules, so this check never refuses a name the provider accepts: it only decides which code the refusal carries.

Values are never inspected. They are always sent as parameters, so text such as Robert'); DROP TABLE x;-- is stored exactly as typed and can't change the SQL; refusing it would refuse real data (O'Brien, "a -- b").