From fef8eb5085608143663910d4aa1304e682941b8f Mon Sep 17 00:00:00 2001 From: ExtReMLapin <3909752+ExtReMLapin@users.noreply.github.com> Date: Mon, 3 Mar 2025 10:09:41 +0100 Subject: [PATCH 1/2] fixes code injection because cypher allows new line with single quote --- .../groovy/StringTranslationUtils.java | 22 ++++++++++++++----- 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/translation/src/main/java/org/opencypher/gremlin/translation/groovy/StringTranslationUtils.java b/translation/src/main/java/org/opencypher/gremlin/translation/groovy/StringTranslationUtils.java index 7c97c068b..e4d1ef8fd 100644 --- a/translation/src/main/java/org/opencypher/gremlin/translation/groovy/StringTranslationUtils.java +++ b/translation/src/main/java/org/opencypher/gremlin/translation/groovy/StringTranslationUtils.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2018-2019 "Neo4j, Inc." [https://neo4j.com] + * Copyright (c) 2018-2025 "Neo4j, Inc." [https://neo4j.com] * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -75,12 +75,22 @@ public static String toLiteral(Object argument) { return argument.toString(); } - private static String toStringLiteral(String agrument) { - String s = agrument.replaceAll("(['\\\\])", "\\\\$1"); - if (s.contains("\n")) { - return "\"\"\"" + s + "\"\"\""; + private static String toStringLiteral(String argument) { + if (argument.contains("\n")) { + // Handle multiline strings + if (argument.contains("\"\"\"")) { + // If the string contains """, use single quotes and escape newlines and quotes + return "'" + argument.replaceAll("(['\\\\])", "\\\\$1") + .replaceAll("\n", "\\\\n") + .replaceAll("\r", "\\\\r") + "'"; + } else { + // Use triple quotes for multiline strings, but escape any ending triple quotes + String processed = argument.replaceAll("\"\"\"", "\\\\\"\\\\\"\\\\\""); + return "\"\"\"" + processed + "\"\"\""; + } } else { - return "'" + s + "'"; + // For single line strings, use the original approach with single quotes + return "'" + argument.replaceAll("(['\\\\])", "\\\\$1") + "'"; } } From 74519a0e99647ee6772f2144ba51f4b57b0764a9 Mon Sep 17 00:00:00 2001 From: ExtReMLapin <3909752+ExtReMLapin@users.noreply.github.com> Date: Tue, 18 Mar 2025 15:17:02 +0100 Subject: [PATCH 2/2] update copyright year in StringTranslationUtils.java (compiler keeps crying about it) --- .../gremlin/translation/groovy/StringTranslationUtils.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/translation/src/main/java/org/opencypher/gremlin/translation/groovy/StringTranslationUtils.java b/translation/src/main/java/org/opencypher/gremlin/translation/groovy/StringTranslationUtils.java index e4d1ef8fd..51d865a00 100644 --- a/translation/src/main/java/org/opencypher/gremlin/translation/groovy/StringTranslationUtils.java +++ b/translation/src/main/java/org/opencypher/gremlin/translation/groovy/StringTranslationUtils.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2018-2025 "Neo4j, Inc." [https://neo4j.com] + * Copyright (c) 2018-2019 "Neo4j, Inc." [https://neo4j.com] * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License.