Merge pull request #1727 from ClickHouse/kavirajk/fix-formatTime-sql-escaping

bug: Fix `formatTime` escaping

Author: kavirajk

bind.go

@@ -2,6 +2,7 @@ package clickhouse
 
 import (
 	std_driver "database/sql/driver"
+	"errors"
 	"fmt"
 	"reflect"
 	"regexp"
@@ -12,6 +13,10 @@ import (
 	"github.com/ClickHouse/clickhouse-go/v2/lib/driver"
 )
 
+var (
+	ErrInvalidTimezone = errors.New("invalid timezone value")
+)
+
 func Named(name string, value any) driver.NamedValue {
 	return driver.NamedValue{
 		Name:  name,
@@ -228,7 +233,9 @@ func bindNamed(tz *time.Location, query string, args ...any) (_ string, err erro
 }
 
 func formatTime(tz *time.Location, scale TimeUnit, value time.Time) (string, error) {
-	switch value.Location().String() {
+	locVal := value.Location().String()
+
+	switch locVal {
 	case "Local", "":
 		// It's required to pass timestamp as string due to decimal overflow for higher precision,
 		// but zero-value string "toDateTime('0')" will be not parsed by ClickHouse.
@@ -252,10 +259,17 @@ func formatTime(tz *time.Location, scale TimeUnit, value time.Time) (string, err
 		}
 		return fmt.Sprintf("toDateTime64('%s', %d)", value.Format(fmt.Sprintf("2006-01-02 15:04:05.%0*d", int(scale*3), 0)), int(scale*3)), nil
 	}
+
+	// Escape the timezone string (timezone may contain malicious SQL query)
+	escapedTimezone := stringQuoteReplacer.Replace(locVal)
+	if locVal != escapedTimezone {
+		return "", fmt.Errorf("%w: %q", ErrInvalidTimezone, locVal)
+	}
+
 	if scale == Seconds {
-		return fmt.Sprintf("toDateTime('%s', '%s')", value.Format("2006-01-02 15:04:05"), value.Location().String()), nil
+		return fmt.Sprintf("toDateTime('%s', '%s')", value.Format("2006-01-02 15:04:05"), escapedTimezone), nil
 	}
-	return fmt.Sprintf("toDateTime64('%s', %d, '%s')", value.Format(fmt.Sprintf("2006-01-02 15:04:05.%0*d", int(scale*3), 0)), int(scale*3), value.Location().String()), nil
+	return fmt.Sprintf("toDateTime64('%s', %d, '%s')", value.Format(fmt.Sprintf("2006-01-02 15:04:05.%0*d", int(scale*3), 0)), int(scale*3), escapedTimezone), nil
 }
 
 var stringQuoteReplacer = strings.NewReplacer(`\`, `\\`, `'`, `\'`)

bind_test.go

@@ -330,6 +330,54 @@ func TestFormatMap(t *testing.T) {
 	assert.Equal(t, "map('a', 1)", val)
 }
 
+func TestTimezoneSQLEscaping(t *testing.T) {
+	t.Run("prevent SQL injection via timezone name", func(t *testing.T) {
+		maliciousLoc := time.FixedZone("UTC') UNION ALL SELECT 1,2,3 --", 0)
+		time.LoadLocation(maliciousLoc.String())
+		maliciousTime := time.Now().In(maliciousLoc)
+
+		val, err := format(time.UTC, Seconds, maliciousTime)
+		require.Error(t, err)
+		assert.Equal(t, "", val)
+		assert.ErrorIs(t, err, ErrInvalidTimezone)
+	})
+
+	t.Run("prevent SQL injection via timezone name with milliseconds", func(t *testing.T) {
+		maliciousLoc := time.FixedZone("America/New_York'); DROP TABLE users; --", 0)
+		maliciousTime := time.Now().In(maliciousLoc)
+
+		val, err := format(time.UTC, MilliSeconds, maliciousTime)
+		require.Error(t, err)
+		assert.Equal(t, "", val)
+		assert.ErrorIs(t, err, ErrInvalidTimezone)
+	})
+
+	t.Run("prevent SQL injection via timezone with backslashes", func(t *testing.T) {
+		maliciousLoc := time.FixedZone(`UTC\' OR 1=1 --`, 0)
+		maliciousTime := time.Now().In(maliciousLoc)
+
+		val, err := format(time.UTC, Seconds, maliciousTime)
+		// require.NoError(t, err)
+		require.Error(t, err)
+		assert.Equal(t, "", val)
+		assert.ErrorIs(t, err, ErrInvalidTimezone)
+	})
+
+	t.Run("normal timezone names remain unaffected", func(t *testing.T) {
+		// Test that normal, safe timezone names still work correctly
+		normalLoc := time.FixedZone("America/New_York", -5*3600)
+		normalTime := time.Now().In(normalLoc)
+
+		val, err := format(time.UTC, Seconds, normalTime)
+		require.NoError(t, err)
+
+		// Should contain the timezone name without any escaping
+		assert.Contains(t, val, "'America/New_York'")
+		assert.NotContains(t, val, `\'`, "Normal timezone names should not have escaped quotes")
+		assert.Contains(t, val, "toDateTime(")
+	})
+}
+
 // a simple (non thread safe) ordered map, implementing the column.OrderedMap interface
 type OrderedMap struct {
 	keys   []any