Method asSql

subprojects/groovy-sql/src/main/java/groovy/sql/Sql.java:4624–4687

Hook to allow derived classes to override sql generation from GStrings. @param gstring a GString containing the SQL query with embedded params @param values the values to embed @return the SQL version of the given query using ? instead of any parameter @throws SQLException if a quoted dynamic expr

(GString gstring, List<?> values)

     * @see #expand(Object)
     */
    protected String asSql(GString gstring, List<?> values) throws SQLException {
        String[] strings = gstring.getStrings();
        if (strings.length <= 0) {
            throw new IllegalArgumentException("No SQL specified in GString: " + gstring);
        }
        boolean nulls = false;
        StringBuilder buffer = new StringBuilder();
        boolean warned = false;
        Iterator<?> iter = values.iterator();
        for (int i = 0; i < strings.length; i++) {
            String text = strings[i];
            if (text != null) {
                buffer.append(text);
            }
            if (iter.hasNext()) {
                Object value = iter.next();
                if (value != null) {
                    if (value instanceof ExpandedVariable) {
                        buffer.append(((ExpandedVariable) value).getObject());
                        iter.remove();
                    } else {
                        boolean validBinding = true;
                        if (i < strings.length - 1) {
                            String nextText = strings[i + 1];
                            if ((text.endsWith("\"") || text.endsWith("'")) && (nextText.startsWith("'") || nextText.startsWith("\""))) {
                                String unsafeExpression = buffer.toString() + "?" + nextText;
                                if (!Boolean.getBoolean(INJECTION_LENIENT)) {
                                    throw new SQLException("Detected a quoted dynamic expression (one starting with $) in a " +
                                            "Groovy SQL query. Surrounding such an expression with quotes prevents the use of a " +
                                            "JDBC PreparedStatement and exposes a SQL injection vulnerability. Remove the surrounding " +
                                            "quotes so the value can be bound safely as a parameter. The unsafe expression so far is: " +
                                            unsafeExpression + ". To restore the previous (insecure) behaviour, set the system property '" +
                                            INJECTION_LENIENT + "' to 'true'.");
                                }
                                if (!warned) {
                                    LOG.warning("In Groovy SQL please do not use quotes around dynamic expressions " +
                                            "(which start with $) as this means we cannot use a JDBC PreparedStatement " +
                                            "and so is a security hole. The '" + INJECTION_LENIENT + "' system property is set to 'true' " +
                                            "so Groovy has worked around your mistake but the security hole is still there. " +
                                            "The expression so far is: " + unsafeExpression);
                                    warned = true;
                                }
                                buffer.append(value);
                                iter.remove();
                                validBinding = false;
                            }
                        }
                        if (validBinding) {
                            buffer.append("?");
                        }
                    }
                } else {
                    nulls = true;
                    iter.remove();
                    buffer.append("?'\"?"); // will replace these with nullish values
                }
            }
        }