sneaql 0.0.12-java → 0.0.13-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 782dd6823d85946ec67bf1f3386df376fd73fe75
-  data.tar.gz: 8579df76b676d3b3ad6a8cbc868940c9c98ae106
+  metadata.gz: 1691a3f7c5849f131d0c93b224dec808c78877d1
+  data.tar.gz: 6ecfdbd3c59590059ae603b85c6694ebab7174d0
 SHA512:
-  metadata.gz: d690724dc1c9233b4ed2377bf54c4aa43f2a5aa9c2dd4cd23ae8b112d508aea340a8df0c486fec07b6fa53d2175e2b0160c0a7f37157f31721b931b9a13cba7b
-  data.tar.gz: c8f1073dad3e852eb85e58758d5af6fe09093a9a9e2bd78334f1cd1764466c722e6ac3fffbbf4348911d0e84a19cece36c142005912081789c913a88e27162e6
+  metadata.gz: d38ec6c6d5ffcafd8090163e47e0ae3d77691ed8411a469fe1e653b24e7d88dbda0fb6b16bcf7ca373c27b0988801355960abecbccc2c7f528165acb50dac26a
+  data.tar.gz: 8c584cfeb4e4dfd5655aaf3bc6e19bb1da042281ef9c09dab2a0b0f593d8b28abddccbb95d91068795c718f67f950a717e575aba910e1dc02a91b17b03e0ea7b

data/bin/sneaql

@@ -91,11 +91,27 @@ the above will execute the transform in the current directory.  note that sneaql
       
       def exec(transform_path)
         begin
+          # default log level
           logger.level = Logger::INFO
-          logger.level = Logger::DEBUG if options[:debug] == true
           
+          # bring in the env vars  
           Dotenv.load(options[:env_file] ? options[:env_file] : 'sneaql.env')
           
+          # set log level if provided
+          if ENV['SNEAQL_LOG_LEVEL']
+            case ENV['SNEAQL_LOG_LEVEL'].downcase
+              when 'debug' then logger.level = Logger::DEBUG
+              when 'warn' then logger.level = Logger::WARN
+              when 'error' then logger.level = Logger::ERROR
+              when 'fatal' then logger.level = Logger::FATAL
+              else
+                raise "log level #{ENV['SNEAQL_LOG_LEVEL']} not supported"
+            end
+          end
+          
+          # debug flag takes precedence
+          logger.level = Logger::DEBUG if options[:debug] == true
+          
           base_path = File.expand_path(transform_path)
           raise 'base_path not provided' if base_path == nil
           
@@ -116,6 +132,7 @@ the above will execute the transform in the current directory.  note that sneaql
           
           jdbc_driver_class = options[:jdbc_driver_class] ? options[:jdbc_driver_class] : ENV['SNEAQL_JDBC_DRIVER_CLASS']
           raise 'jdbc_driver_class not provided' if step_file == nil
+          
         rescue => e
           puts e.message
           exit 1
@@ -175,7 +192,7 @@ the above will execute the transform in the current directory.  note that sneaql
       method_option :debug , :default => false, :type => :boolean
       
   		long_desc <<-LONGDESC
-executes the transform provided
+validates the transform without actually running it
 
 PARAMETERS
 
@@ -196,11 +213,27 @@ the above will execute the transform in the current directory.  note that sneaql
       
       def dryrun(transform_path)
         begin
+          # default log level
           logger.level = Logger::INFO
-          logger.level = Logger::DEBUG if options[:debug] == true
           
+          # bring in the env vars  
           Dotenv.load(options[:env_file] ? options[:env_file] : 'sneaql.env')
-
+          
+          # set log level if provided
+          if ENV['SNEAQL_LOG_LEVEL']
+            case ENV['SNEAQL_LOG_LEVEL'].downcase
+              when 'debug' then logger.level = Logger::DEBUG
+              when 'warn' then logger.level = Logger::WARN
+              when 'error' then logger.level = Logger::ERROR
+              when 'fatal' then logger.level = Logger::FATAL
+              else
+                raise "log level #{ENV['SNEAQL_LOG_LEVEL']} not supported"
+            end
+          end
+          
+          # debug flag takes precedence
+          logger.level = Logger::DEBUG if options[:debug] == true
+          
           base_path = File.expand_path(transform_path)
           raise 'base_path not provided' if base_path == nil
           

data/lib/sneaql_lib/base.rb

@@ -112,7 +112,7 @@ module Sneaql
             valid << valid_recordset?(a)
           else valid << false end
         end
-        @logger.debug(valid)
+        @logger.debug("arg validation results: #{valid}")
         !valid.include?(false)
       end
 

data/lib/sneaql_lib/docker.rb

@@ -31,9 +31,9 @@ module Sneaql
       end
 
       def dockerfile()
-%{FROM sneaql:0.0.1
-RUN mkdir /tmp/repo 
-#{@step_files.map {|s| "ADD #{s[:local_path]} /tmp/repo/#{s[:docker_path]}"}.join("\n")}
+%{FROM full360/sneaql:latest
+RUN mkdir /repo 
+#{@step_files.map {|s| "ADD #{s[:local_path]} /repo/#{s[:docker_path]}"}.join("\n")}
 }
       end
 

data/lib/sneaql_lib/expressions.rb

@@ -12,6 +12,8 @@ module Sneaql
       def initialize(logger = nil)
         @logger = logger ? logger : Logger.new(STDOUT)
         @environment_variables = filtered_environment_variables
+        validate_environment_variables unless ENV['SNEAQL_DISABLE_SQL_INJECTION_CHECK']
+        @environment_variables.freeze
         @session_variables = {}
       end
 
@@ -72,6 +74,12 @@ module Sneaql
           @logger.warn '{var_name} deprecated. use dynamic SQL syntax :var_name'
           return @session_variables[expression.gsub(/\{|\}/, '').strip]
 
+        # boolean
+        elsif ['true', 'false'].include?(expression.downcase)
+          @logger.debug "handling #{expression} as boolean"
+          return true if expression.downcase == 'true'
+          return false if expression.downcase == 'false'
+
         # string literal enclosed in single quotes
         # only works for a single word... no whitespace allowed at this time
         elsif expression =~ /\'.*\'/
@@ -147,7 +155,7 @@ module Sneaql
       # checks to see this is single quoted string, :variable_name, {var_name) or number (1, 1.031, etc.)
       # @param [String] expr value to check
       def valid_expression_reference?(expr)
-        return expr.to_s.match(/(^\'.+\'$|^\:\w+$|^\{\w+\}$|^\d+$|^\d+\.\d*$)/) ? true : false
+        return expr.to_s.match(/(^\'.+\'$|^\:\w+$|^\{\w+\}$|^\d+$|^\d+\.\d*$|true|false)/i) ? true : false
       end
 
       # Operators valid for expression comparison
@@ -159,6 +167,7 @@ module Sneaql
       # provides a standardized method of comparing two expressions.
       # note that this only works for variables and constants.
       # current version supports float, integer, and contigious strings.
+      # as of 0.0.13 expressions need to be evaluated before being passed
       # @param [String] operator comparison operator @see valid_operators
       # @param [String] exp1 expression for left operand
       # @param [String] exp2 expression for right operand
@@ -171,10 +180,9 @@ module Sneaql
 
         # evaluate exps and coerce data types
         coerced = coerce_data_types(
-          evaluate_expression(exp1),
-          evaluate_expression(exp2)
+          exp1,
+          exp2
         )
-
         compare_values(operator, coerced[0], coerced[1])
       end
 
@@ -184,8 +192,14 @@ module Sneaql
       # @return [Array<Float, Fixnum, String>] returns array with both input expressions coerced to the same data type
       def coerce_data_types(exp1, exp2)
         # coerce data types to make for a good comparison
+        @logger.debug("coercing types #{[exp1.class, exp2.class]}")
         if exp1.class == exp2.class
           nil # nothing to do... continue with comparison
+        elsif ([exp1.class, exp2.class].include?(FalseClass)) or ([exp1.class, exp2.class].include?(TrueClass))
+          unless [coerce_boolean(exp1), coerce_boolean(exp2)].include?(nil)
+            exp1 = coerce_boolean(exp1)
+            exp2 = coerce_boolean(exp2)
+          end
         elsif [exp1.class, exp2.class].include? Float
           # if either is a float then make sure they are both floats
           exp1 = exp1.to_f
@@ -195,9 +209,32 @@ module Sneaql
           exp1 = exp1.to_i
           exp2 = exp2.to_i
         end
+        @logger.debug("coerced types #{[exp1.class, exp2.class]}")
         [exp1, exp2]
       end
 
+      # evaluates string or fixnum values to coerce into boolean
+      # @param [Object] value
+      # @return [Object]
+      def coerce_boolean(value)
+        retval = nil
+        if [TrueClass, FalseClass].include?(value.class)
+          retval = value
+        elsif value.class == Fixnum
+          retval = true if value == 1
+          retval = false if value == 0
+        elsif value.class == String
+          tmp = value.downcase.strip
+          case tmp
+          when 'f', 'false', '0'
+            retval = false
+          when 't', 'true', '1'
+            retval = true
+          end
+        end
+        return retval
+      end
+
       # performs the actual comparison between two values
       # @param [String] operator comparison operator @see valid_operators
       # @param [String] exp1 expression for left operand
@@ -233,8 +270,8 @@ module Sneaql
       def wildcard_to_regex(wildcard)
         Regexp.new("^#{wildcard}$".gsub('%','.*').gsub('_','.'))
       end
-      
-      # create a hash built from supplied environment variables. 
+
+      # create a hash built from supplied environment variables.
       # if SNEAQL_AVAILABLE_ENV_VARS is provided (as a comma delimited list)
       # only the listed values are included.
       # return <Hash>
@@ -250,6 +287,24 @@ module Sneaql
         end
         return env_vars
       end
+
+      # basic regex filtering to help combat sql injection
+      # by way of environment variables
+      # @param [String] value value for validation
+      # @return [Boolean] returns true if value is safe
+      def sql_injection_filter(value)
+        return false if value.to_s.match(/(\'|\;|(drop|alter).*(table|user|view|column|database|schema|function|sequence|procedure))/i)
+        return true
+      end
+
+      # insures that all environment variables pass SQL injection test
+      def validate_environment_variables
+        @environment_variables.keys.each do |k|
+          unless sql_injection_filter(@environment_variables[k])
+            raise 'SQL Injection Filter Error'
+          end
+        end
+      end
     end
   end
 end

data/lib/sneaql_lib/recordset.rb

@@ -81,8 +81,8 @@ module Sneaql
           @logger.debug("applying #{exp} to #{record}")
           raw_result = @expression_manager.compare_expressions(
             exp[:operator],
-            record[exp[:field]],
-            exp[:expression]
+            @expression_manager.evaluate_expression(record[exp[:field]]),
+            @expression_manager.evaluate_expression(exp[:expression])
           )
           if exp[:condition] == 'include'
             conditions << raw_result

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sneaql
 version: !ruby/object:Gem::Version
-  version: 0.0.12
+  version: 0.0.13
 platform: java
 authors:
 - jeremy winters
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-04-04 00:00:00.000000000 Z
+date: 2017-04-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement