Skip to content

Catch when the user adds too many parameters #755

@sbla-jyskebank-dk

Description

@sbla-jyskebank-dk

Say I do something silly like

var isAdmin = <result of propper auth check>
...
.SelectRaw("SUM(CASE WHEN [Books].[Preprints] > 2 THEN 1 ELSE 0 END)", 1)
.Where("User.IsAdmin", isAdmin)
...

It would be nice to get an error for the mismatch in parameter counts, or if the erroneous true parameter is simply ignored.

Instead, using SqlKata.Execution 4.0.1 with the SqlServerCompiler, the compiled SQL is sent to the database, with the following named parameters:

@p0 = 1, @p1 = <result of propper auth check>

SQL Server will then use @p0 in the authcheck, and ignore @p1.

I can see that this doesn't happen in the playground, leading me to suspect a check might simply be missing in the SqlServerCompiler, or an issue introduced in a later version?

This is ofc, a user-error by the programmer, but since it may result in accidentally doing something akin to an sql injection attack, it would be great if it was handled.

I'm surprised SqlServer doesn't raise an error. Is there ever a legitimate reason to want to send more parameters than have been bound/named?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions