Fix #16057 Don't allow numbers with letters

phpmyadmin · Apr 14, 2020 · baf83b4 · baf83b4
1 parent f9dc9d2
commit baf83b4
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/src/Lexer.php b/src/Lexer.php
@@ -756,6 +756,7 @@ public function parseNumber()
         //
         // Valid final states are: 2, 3, 4 and 6. Any parsing that finished in a
         // state other than these is invalid.
+        // Also, negative states are invalid states.
         $iBak = $this->last;
         $token = '';
         $flags = 0;
@@ -798,6 +799,10 @@ public function parseNumber()
                     $state = 4;
                 } elseif ($this->str[$this->last] === 'e' || $this->str[$this->last] === 'E') {
                     $state = 5;
+                } elseif (($this->str[$this->last] >= 'a' && $this->str[$this->last] <= 'z')
+                    || ($this->str[$this->last] >= 'A' && $this->str[$this->last] <= 'Z')) {
+                    // A number can't be directly followed by a letter
+                    $state = -$state;
                 } elseif ($this->str[$this->last] < '0' || $this->str[$this->last] > '9') {
                     // Just digits and `.`, `e` and `E` are valid characters.
                     break;
@@ -806,6 +811,10 @@ public function parseNumber()
                 $flags |= Token::FLAG_NUMBER_FLOAT;
                 if ($this->str[$this->last] === 'e' || $this->str[$this->last] === 'E') {
                     $state = 5;
+                } elseif (($this->str[$this->last] >= 'a' && $this->str[$this->last] <= 'z')
+                    || ($this->str[$this->last] >= 'A' && $this->str[$this->last] <= 'Z')) {
+                    // A number can't be directly followed by a letter
+                    $state = -$state;
                 } elseif ($this->str[$this->last] < '0' || $this->str[$this->last] > '9') {
                     // Just digits, `e` and `E` are valid characters.
                     break;
@@ -816,6 +825,10 @@ public function parseNumber()
                     || ($this->str[$this->last] >= '0' && $this->str[$this->last] <= '9')
                 ) {
                     $state = 6;
+                } elseif (($this->str[$this->last] >= 'a' && $this->str[$this->last] <= 'z')
+                    || ($this->str[$this->last] >= 'A' && $this->str[$this->last] <= 'Z')) {
+                    // A number can't be directly followed by a letter
+                    $state = -$state;
                 } else {
                     break;
                 }

diff --git a/tests/Utils/QueryTest.php b/tests/Utils/QueryTest.php
@@ -416,14 +416,26 @@ public function getTablesProvider()
                 'INSERT INTO tbl(`id`, `name`) VALUES (1, "Name")',
                 array('`tbl`')
             ),
+            array(
+                'INSERT INTO 0tbl(`id`, `name`) VALUES (1, "Name")',
+                array('`0tbl`')
+            ),
             array(
                 'UPDATE tbl SET id = 0',
                 array('`tbl`')
             ),
+            array(
+                'UPDATE 0tbl SET id = 0',
+                array('`0tbl`')
+            ),
             array(
                 'DELETE FROM tbl WHERE id < 10',
                 array('`tbl`')
             ),
+            array(
+                'DELETE FROM 0tbl WHERE id < 10',
+                array('`0tbl`')
+            ),
             array(
                 'TRUNCATE tbl',
                 array('`tbl`')