<?php
 namespace Modules\Utils\AppReports; class SqlManager extends \App\Config\XmlDynamicRecordsAbstract { protected $fileName = 'appReports.xml'; protected function constructInit() { $CFG = \Engine\Loader_Cfg::getInstance()->getGlobal(); if (!$this->fileName) { throw new \Exception('You did not set the `fileName` attribute for the class `'.get_called_class().'`.'); } $this->fileNameWithPath = APP_REAL_PATH . $CFG['paths']['temporary'] . $this->fileName; } protected function getAll_rawData_extractDataFromFile_list(\SimpleXMLElement $xml) { $return=[]; foreach($xml->report as $appReport) { $return[(String)$appReport->name] = [ "name" => (String)$appReport->name, "sql" => (String)$appReport->sql, "monthTable" => (String)$appReport->monthTable, ]; } return $return; } protected function getAll_rawData_extractDataFromFile_default(\SimpleXMLElement $xml) { return ''; } protected function getAll_rawData_extractDataFromFile_mandatory(\SimpleXMLElement $xml) { return false; } protected function itemCheck($code, $itemDetails) { if (!$itemDetails) $this->addErrorMessage('The appReport data details was not defined.'); if (!$code) $this->addErrorMessage('The app report name is not set.'); if (!$itemDetails['name']) { $this->addErrorMessage('The name is not set.'); } if (!$itemDetails['sql']) { $this->addErrorMessage('The sql is not set.'); } if ($itemDetails['sql'] and strtoupper(substr(ltrim($itemDetails['sql']), 0, 6)) !== 'SELECT') { $this->addErrorMessage('The sql does not contain `SELECT`.'); } if ($itemDetails['sql']) { $this->checkForbiddenPatterns($itemDetails['sql']); } } private function checkForbiddenPatterns($sql) { $forbidden = [ '/\bINTO\s+(OUTFILE|DUMPFILE)\b/i', '/\bLOAD_FILE\s*\(/i', '/\bSLEEP\s*\(/i', '/\bBENCHMARK\s*\(/i', '/\bGET_LOCK\s*\(/i', '/\b(REPEAT|SPACE)\s*\(/i', '/\b(ExtractValue|UpdateXML)\s*\(/i', '/\binformation_schema\b/i', '/\bperformance_schema\b/i', '/\bmysql\s*\.\s*\w/i', '/\bsys\s*\.\s*\w/i', '/;\s*(DROP|DELETE|UPDATE|INSERT|TRUNCATE|ALTER|CREATE|REPLACE|RENAME)\b/i', ]; foreach ($forbidden as $pattern) { if (preg_match($pattern, $sql)) { $this->addErrorMessage('The sql contains a forbidden operation.'); } } } protected function save_check() { } protected function save_write_do_getXml() { $xml=simplexml_load_string('<?xml version="1.0" encoding="UTF-8"?><reports />'); foreach ($this->itemsList as $currReport) { $currentXML = $xml->addChild('report', ''); $currentXML->name = $currReport['name']; $currentXML->sql = $currReport['sql']; $currentXML->monthTable = $currReport['monthTable']; } return $xml; } } 