phaneron/Kelsidavis-WoWee
1
0
Fork 0
mirror of https://github.com/Kelsidavis/WoWee.git synced 2026-05-07 01:23:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(editor): escape user strings in server module map/zone/tele SQL

Browse source 
The map_dbc, area_table_dbc, and game_tele INSERTs previously
embedded mapName/displayName/manifest.mapName as raw strings — a
zone called "King's Land" or anything containing a single quote
would emit malformed SQL that AzerothCore would reject. Promotes
the existing escapeSql helper to a public SQLExporter::escape and
uses it in all three INSERTs.
This commit is contained in:
Kelsi 2026-05-06 06:46:58 -07:00
parent cc1e1cb7fa
commit a8464fc367
3 changed files with 22 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
tools/editor/server_module_gen.cpp
View file

@ -36,17 +36,22 @@ bool ServerModuleGenerator::generate(const ZoneManifest& manifest,
f << "-- Generated: " << timeBuf << "\n";
f << "-- Map ID: " << cfg.mapId << "\n\n";
// Escape user-provided strings — a zone name like "King's Land"
// would otherwise produce invalid SQL.
const std::string mapName = SQLExporter::escape(cfg.mapName);
const std::string displayName = SQLExporter::escape(cfg.displayName);
f << "-- Register custom map\n";
f << "INSERT INTO `map_dbc` (`ID`, `MapName`, `MapType`, `MapDescription`) VALUES ("
<< cfg.mapId << ", '" << cfg.mapName << "', 0, '"
<< cfg.displayName << "') ON DUPLICATE KEY UPDATE `MapName`='"
<< cfg.mapName << "';\n\n";
<< cfg.mapId << ", '" << mapName << "', 0, '"
<< displayName << "') ON DUPLICATE KEY UPDATE `MapName`='"
<< mapName << "';\n\n";
f << "-- Register zone area\n";
f << "INSERT INTO `area_table_dbc` (`ID`, `MapID`, `AreaName`, `ExploreFlag`) VALUES ("
<< cfg.zoneId << ", " << cfg.mapId << ", '"
<< cfg.displayName << "', 1) ON DUPLICATE KEY UPDATE `AreaName`='"
<< cfg.displayName << "';\n";
<< displayName << "', 1) ON DUPLICATE KEY UPDATE `AreaName`='"
<< displayName << "';\n";
}
// 2. Generate creature + quest SQL
@ -63,9 +68,10 @@ bool ServerModuleGenerator::generate(const ZoneManifest& manifest,
float tileSize = 533.33333f;
float x = (32.0f - manifest.tiles[0].second) * tileSize;
float y = (32.0f - manifest.tiles[0].first) * tileSize;
const std::string teleName = SQLExporter::escape(manifest.mapName);
f << "INSERT INTO `game_tele` (`name`, `position_x`, `position_y`, "
<< "`position_z`, `orientation`, `map`) VALUES ('"
<< manifest.mapName << "', " << x << ", " << y << ", "
<< teleName << "', " << x << ", " << y << ", "
<< manifest.baseHeight + 10.0f << ", 0, " << cfg.mapId
<< ") ON DUPLICATE KEY UPDATE `position_x`=" << x << ";\n";
f << "\n-- Usage: .tele " << manifest.mapName << "\n";

5
tools/editor/sql_exporter.cpp
View file

@ -10,8 +10,9 @@
namespace wowee {
namespace editor {
static std::string escapeSql(const std::string& s) {
std::string SQLExporter::escape(const std::string& s) {
std::string out;
out.reserve(s.size());
for (char c : s) {
if (c == '\'') out += "''";
else if (c == '\\') out += "\\\\";
@ -20,6 +21,8 @@ static std::string escapeSql(const std::string& s) {
return out;
}
static std::string escapeSql(const std::string& s) { return SQLExporter::escape(s); }
bool SQLExporter::exportCreatures(const std::vector<CreatureSpawn>& spawns,
const std::string& path,
uint32_t mapId,

6
tools/editor/sql_exporter.hpp
View file

@ -33,6 +33,12 @@ public:
const std::string& path,
uint32_t mapId = 9000,
uint32_t startEntry = 100000);
// Escape a string for safe inclusion inside single-quoted SQL literal.
// Doubles single quotes and escapes backslashes — matches MySQL/MariaDB
// string literal rules used by AzerothCore/TrinityCore. Use whenever you
// emit user-provided text into SQL outside of this class.
static std::string escape(const std::string& s);
};
} // namespace editor