Merge pull request #51 from clue-labs/multi

Do not support multiple statements for security and API reasons

Author: jsor

src/ConnectionInterface.php

@@ -32,6 +32,11 @@ interface ConnectionInterface
      *
      *  function (QueryCommand $cmd, ConnectionInterface $conn): void
      *
+     * The given `$sql` parameter MUST contain a single statement. Support
+     * for multiple statements is disabled for security reasons because it
+     * could allow for possible SQL injection attacks and this API is not
+     * suited for exposing multiple possible results.
+     *
      * @return QueryCommand|null Return QueryCommand if $callback not specified.
      * @throws Exception if the connection is not initialized or already closed/closing
      */

src/Protocal/Parser.php

@@ -425,8 +425,6 @@ public function authenticate()
                 Constants::CLIENT_INTERACTIVE |
                 Constants::CLIENT_TRANSACTIONS |
                 Constants::CLIENT_SECURE_CONNECTION |
-                Constants::CLIENT_MULTI_RESULTS |
-                Constants::CLIENT_MULTI_STATEMENTS |
                 Constants::CLIENT_CONNECT_WITH_DB;
 
         $packet = pack('VVc', $clientFlags, $this->maxPacketSize, $this->charsetNumber)

tests/ResultQueryTest.php

@@ -460,7 +460,7 @@ public function testSimpleSelect()
         $loop->run();
     }
 
-    public function testInvalidSelect()
+    public function testInvalidSelectShouldFail()
     {
         $loop = \React\EventLoop\Factory::create();
 
@@ -478,6 +478,22 @@ public function testInvalidSelect()
         $loop->run();
     }
 
+    public function testInvalidMultiStatementsShouldFailToPreventSqlInjections()
+    {
+        $loop = \React\EventLoop\Factory::create();
+
+        $connection = new \React\MySQL\Connection($loop, $this->getConnectionOptions());
+        $connection->connect(function () {});
+
+        $connection->query('select 1;select 2;', function ($command, $conn) {
+            $this->assertEquals(true, $command->hasError());
+            $this->assertContains("You have an error in your SQL syntax", $command->getError()->getMessage());
+        });
+
+        $connection->close();
+        $loop->run();
+    }
+
     public function testEventSelect()
     {
         $this->expectOutputString('result.result.results.end.');