Reporting: Break out report_blessingscond

The returned SQL is a self-contained expression, and does not require
additional bind parameters.  To spot SQL quoting problems, we die if
a blessing is not reasonable.

The use sites of the $blessingcond in sg-report-flight are adjusted to
no longer pass @blessings to execute.

No overall functional change with reasonable blessings.

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>

diff --git a/Osstest/Executive.pm b/Osstest/Executive.pm
index eb01fd1027f73c88ee5d23843341fe8b6c7c5e29..b757618b0060c28eeb8eb22a93775cdd2774b29e 100644 (file)
--- a/Osstest/Executive.pm
+++ b/Osstest/Executive.pm
@@ -47,6 +47,7 @@ BEGIN {
     @EXPORT      = qw(get_harness_rev grabrepolock_reexec
                       findtask @all_lock_tables
                       report_run_getinfo report_altcolour
+                      report_blessingscond
                       tcpconnect_queuedaemon plan_search
                       alloc_resources alloc_resources_rollback_begin_work
                       resource_check_allocated resource_shared_mark_ready
@@ -246,6 +247,18 @@ sub report_altcolour ($) {
     return "bgcolor=\"#".(qw(d0d0d0 ffffff))[$bool]."\"";
 }
 
+sub report_blessingscond ($$) {
+    my ($blessings, $maxflight) = @_;
+    my $blessingscond= '('.join(' OR ', map {
+       die if m/[^-_.0-9a-z]/;
+       "blessing='$_'"
+                               } @$blessings).')';
+    if (defined $maxflight) {
+       $blessingscond= "( flight <= $maxflight AND $blessingscond )";
+    }
+    return $blessingscond;
+}
+
 #---------- host (and other resource) allocation ----------
 
 our $taskid;

diff --git a/sg-report-flight b/sg-report-flight
index ebb9281bb96e6c50131f85b12f480f1cbbbc09d2..3c360e5fc980629017c39ddf7e700090fb8c0253 100755 (executable)
--- a/sg-report-flight
+++ b/sg-report-flight
@@ -127,11 +127,7 @@ our $cw= 79;
 our $tl= 20;
 our $htmlleaf= "info.html";
 
-our $blessingscond= '('.join(' OR ', map { "blessing=?" } @blessings).')';
-
-if (defined $maxflight) {
-    $blessingscond= "( flight <= $maxflight AND $blessingscond )";
-}
+our $blessingscond= report_blessingscond(\@blessings, $maxflight);
 
 sub displayflightnum ($) {
     my ($flight) = @_;
@@ -202,7 +198,7 @@ END
       ORDER BY blessing ASC, flight DESC
 END
     $flightsq= db_prepare($flightsq);
-    $flightsq->execute(@flightsq_params, @blessings);
+    $flightsq->execute(@flightsq_params);
 
     my $buildflightsq= db_prepare(<<END);
         SELECT val FROM runvars
@@ -691,7 +687,7 @@ END
             next;
         }
 
-        $anypassq->execute($j->{job}, $s->{testid}, @blessings);
+        $anypassq->execute($j->{job}, $s->{testid});
         if (!$anypassq->fetchrow_hashref()) {
             print MRO "never-passed $j->{job} $s->{testid} $st\n";
             print DEBUG " never passed\n";