Merge pull request #335 from CartoDB/s1669-sql_api_injection_query_tables

Don't rely on regexp to identify non explainable queries

scripts-available/CDB_QueryTables.sql

@@ -11,19 +11,16 @@ DECLARE
   rec RECORD;
   rec2 RECORD;
 BEGIN
-  
+
   tables := '{}';
 
   FOR rec IN SELECT CDB_QueryStatements(query) q LOOP
-
-    IF NOT ( rec.q ilike 'select%' or rec.q ilike 'with%' ) THEN
-        --RAISE WARNING 'Skipping %', rec.q;
-        CONTINUE;
-    END IF;
-
     BEGIN
       EXECUTE 'EXPLAIN (FORMAT XML, VERBOSE) ' || rec.q INTO STRICT exp;
-    EXCEPTION WHEN others THEN
+    EXCEPTION WHEN syntax_error THEN
+      -- We can get a syntax error if the user tries to EXPLAIN a DDL
+      CONTINUE;
+    WHEN others THEN
       -- TODO: if error is 'relation "xxxxxx" does not exist', take xxxxxx as
       --       the affected table ?
       RAISE WARNING 'CDB_QueryTables cannot explain query: % (%: %)', rec.q, SQLSTATE, SQLERRM;

test/CDB_QueryTablesTest_expect

@@ -7,7 +7,7 @@ SELECT 1 as col1; select 2 as col2|{}
 WARNING:  CDB_QueryTables cannot explain query: select 1 from nonexistant (42P01: relation "nonexistant" does not exist)
 ERROR:  relation "nonexistant" does not exist
 begin; select * from pg_class; commit;|{pg_catalog.pg_class}
-WARNING:  CDB_QueryTables cannot explain query: select * from test (42P01: relation "test" does not exist)
+WARNING:  CDB_QueryTables cannot explain query: insert into test values (1) (42P01: relation "test" does not exist)
 ERROR:  relation "test" does not exist
 WITH a AS (select * from pg_class) select * from a|{pg_catalog.pg_class}
 CREATE SCHEMA

test/organization/test.sh

@@ -426,6 +426,12 @@ function test_cdb_querytables_returns_schema_and_table_name() {
     sql cdb_testmember_1 "select * from CDB_QueryTables('select * from foo');" should "{cdb_testmember_1.foo}"
 }
 
+function test_cdb_querytables_works_with_parentheses() {
+    load_sql_file scripts-available/CDB_QueryStatements.sql
+    load_sql_file scripts-available/CDB_QueryTables.sql
+    sql cdb_testmember_1 "select * from CDB_QueryTables('(select * from foo)');" should "{cdb_testmember_1.foo}"
+}
+
 function test_cdb_querytables_returns_schema_and_table_name_for_several_schemas() {
     load_sql_file scripts-available/CDB_QueryStatements.sql
     load_sql_file scripts-available/CDB_QueryTables.sql