Merge pull request #20 from topcoder-platform/CORE-140

feat: increase raw query length limit

Author: eisbilir

src/main/java/com/topcoder/dal/DBAccessor.java

@@ -126,7 +126,7 @@ private Row rawQueryMapper(ResultSet rs, int rowNum) throws SQLException {
                 case java.sql.Types.BIGINT -> valueBuilder.setLongValue(rs.getLong(i + 1));
                 case java.sql.Types.FLOAT -> valueBuilder.setFloatValue(rs.getFloat(i + 1));
                 case java.sql.Types.DOUBLE -> valueBuilder.setDoubleValue(rs.getDouble(i + 1));
-                case java.sql.Types.VARCHAR ->
+                case java.sql.Types.VARCHAR, java.sql.Types.CHAR ->
                     valueBuilder.setStringValue(Objects.requireNonNullElse(rs.getString(i + 1), ""));
                 case java.sql.Types.BOOLEAN -> valueBuilder.setBooleanValue(rs.getBoolean(i + 1));
                 case java.sql.Types.DATE, java.sql.Types.TIMESTAMP -> valueBuilder

src/main/java/com/topcoder/dal/util/QueryHelper.java

@@ -192,23 +192,24 @@ public static String sanitizeSQLStatement(String sql) {
         }
 
         // Limit the length of the SQL statement to prevent very long strings
-        if (sql.length() > 1000) {
+        if (sql.length() > 2000) {
             throw new IllegalArgumentException("SQL statement length exceeds the allowed limit");
         }
 
         // Whitelist characters
         StringBuilder safeSQL = new StringBuilder();
         for (char c : sql.toCharArray()) {
             if (Character.isLetterOrDigit(c) || c == ' ' || c == ',' || c == '(' || c == ')' || c == '=' || c == '<'
-                    || c == '>' || c == '_' || c == ':' || c == '.' || c == '-' || c == '+' || c == '*' || c == '\'') {
+                    || c == '>' || c == '_' || c == ':' || c == '.' || c == '-' || c == '+' || c == '*' || c == '\''
+                    || c == '!') {
                 safeSQL.append(c);
             }
         }
         sql = safeSQL.toString();
 
         // replace single quotes with two single quotes to prevent SQL injection through
         // strings
-        sql = sql.replace("'", "''");
+        // sql = sql.replace("'", "''");
 
         return sql;
     }