geotools/geotools — pull request #186 by GeoffWilliams (2013-04-17 13:46:30+00:00)
Title: Support for escaping sql in VirtualTable class

Support for basic SQL escaping in GeoServer as discussed recently on mailing list.

The GeoTools component handles the actual SQL escaping. This has been done by adding an options flag to the VirtualTable class which is where the regexp processing is also done. I've added a constructor method with support for the new flag as well as setters and getters.

If activated, the SQL will be passed through an escaping function in the new EscapeSql class. This doubles single and double quotes and also strips backslashes.

The option is active by default if the two argument constructor is called, or can be explicitly set if the 3 argument constructor is used.

This should give nice protection against overly simple regexps opening up sites to injection attacks.