diff --git a/lib/DBD/SQLite/VirtualTable/PerlData.pm b/lib/DBD/SQLite/VirtualTable/PerlData.pm index 8b08e60..d5b6bfa 100644 --- a/lib/DBD/SQLite/VirtualTable/PerlData.pm +++ b/lib/DBD/SQLite/VirtualTable/PerlData.pm @@ -214,7 +214,14 @@ sub NEXT { do { $self->{row_ix} += 1 - } until $self->EOF || $self->{is_wanted_row}->($self, $self->{row_ix}); + } until $self->EOF + || eval {$self->{is_wanted_row}->($self, $self->{row_ix})}; + + # NOTE: the eval above is required for cases when user data, injected + # into Perl comparison operators, generates errors; for example + # WHERE col MATCH '(foo' will die because the regex is not well formed + # (no matching parenthesis). In such cases no row is selected and the + # query just returns an empty list. } diff --git a/t/virtual_table/rt_99748.t b/t/virtual_table/rt_99748.t index 9566e08..7c18cdf 100644 --- a/t/virtual_table/rt_99748.t +++ b/t/virtual_table/rt_99748.t @@ -12,7 +12,8 @@ use Test::NoWarnings; # tests that the MATCH operator does not allow code injection my @interpolation_attempts = ( '@{[die -1]}', - # '(?{die 999})', # Eval-group not allowed at runtime + '(foobar', # will die - incorrect regex + '(?{die 999})', # will die - Eval-group not allowed at runtime '$foobar', '$self->{row_ix}', '$main::ARGV[ die 999 ]',