Mirrored_Repos/DarkflameServer
1
0
Fork 0
mirror of https://github.com/DarkflameUniverse/DarkflameServer.git synced 2024-11-24 14:37:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Additional SQLite lookup sanitizing with CDClientDatabase::ExecuteQueryWithArgs()

Browse Source
This commit is contained in:
TheMatt2 2022-01-06 16:05:03 -05:00
parent 590ccc78aa
commit 4796b551ad
3 changed files with 15 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
dDatabase/Tables/CDBehaviorParameterTable.cpp
View File

@ -59,11 +59,9 @@ float CDBehaviorParameterTable::GetEntry(const uint32_t behaviorID, const std::s
}
#ifndef CDCLIENT_CACHE_ALL
std::stringstream query;
query << "SELECT parameterID, value FROM BehaviorParameter WHERE behaviorID = " << std::to_string(behaviorID);
auto tableData = CDClientDatabase::ExecuteQuery(query.str());
auto tableData = CDClientDatabase::ExecuteQueryWithArgs(
"SELECT parameterID, value FROM BehaviorParameter WHERE behaviorID = %u;",
behaviorID);
m_Entries.insert_or_assign(behaviorID, 0);

14
dGame/dComponents/RenderComponent.cpp
View File

@ -198,14 +198,12 @@ void RenderComponent::PlayEffect(const int32_t effectId, const std::u16string& e
return;
}
std::stringstream query;
const std::string effectType_str = GeneralUtils::UTF16ToWTF8(effectType);
auto result = CDClientDatabase::ExecuteQueryWithArgs(
"SELECT animation_length FROM Animations WHERE animation_type IN (SELECT animationName FROM BehaviorEffect WHERE effectID = %d AND effectType = %Q);",
effectId, effectType_str.c_str());
query << "SELECT animation_length FROM Animations WHERE animation_type IN (SELECT animationName FROM BehaviorEffect WHERE effectID = " << std::to_string(effectId) << " AND effectType = '" << GeneralUtils::UTF16ToWTF8(effectType) << "');";
auto result = CDClientDatabase::ExecuteQuery(query.str());
if (result.eof() || result.fieldIsNull(0))
{
if (result.eof() || result.fieldIsNull(0)) {
result.finalize();
m_DurationCache[effectId] = 0;
@ -214,7 +212,7 @@ void RenderComponent::PlayEffect(const int32_t effectId, const std::u16string& e
return;
}
effect->time = static_cast<float>(result.getFloatField(0));
result.finalize();

16
dGame/dInventory/ItemSet.cpp
View File

@ -15,11 +15,9 @@ ItemSet::ItemSet(const uint32_t id, InventoryComponent* inventoryComponent)
this->m_PassiveAbilities = ItemSetPassiveAbility::FindAbilities(id, m_InventoryComponent->GetParent(), this);
std::stringstream query;
query << "SELECT skillSetWith2, skillSetWith3, skillSetWith4, skillSetWith5, skillSetWith6, itemIDs FROM ItemSets WHERE setID = " << std::to_string(id);
auto result = CDClientDatabase::ExecuteQuery(query.str());
auto result = CDClientDatabase::ExecuteQueryWithArgs(
"SELECT skillSetWith2, skillSetWith3, skillSetWith4, skillSetWith5, skillSetWith6, itemIDs FROM ItemSets WHERE setID = %u;",
id);
if (result.eof())
{
@ -33,11 +31,9 @@ ItemSet::ItemSet(const uint32_t id, InventoryComponent* inventoryComponent)
continue;
}
std::stringstream skillQuery;
skillQuery << "SELECT SkillID FROM ItemSetSkills WHERE SkillSetID = " << std::to_string(result.getIntField(i));
auto skillResult = CDClientDatabase::ExecuteQuery(skillQuery.str());
auto skillResult = CDClientDatabase::ExecuteQueryWithArgs(
"SELECT SkillID FROM ItemSetSkills WHERE SkillSetID = %d;",
result.getIntField(i));
if (skillResult.eof())
{