feat(stdlib/sql): add SAP HANA db support

[alespour]

This PR add SAP HANA db support to Flux.

It uses older v0.14.1 Go driver (Mar 16, 2019), because it is the last version that works with Go 1.12.

Done checklist

• Test cases written

[codecov-commenter]

Codecov Report

Merging #3098 into master will increase coverage by 0.01%.
The diff coverage is 54.54%.

@@            Coverage Diff             @@
##           master    #3098      +/-   ##
==========================================
+ Coverage   49.58%   49.60%   +0.01%     
==========================================
  Files         341      342       +1     
  Lines       35727    35844     +117     
==========================================
+ Hits        17716    17781      +65     
- Misses      15543    15587      +44     
- Partials     2468     2476       +8     

Impacted Files	Coverage Δ
stdlib/sql/to.go	45.41% <40.00%> (+0.12%)	⬆️
stdlib/sql/source_validator.go	75.00% <50.00%> (-1.93%)	⬇️
stdlib/sql/hdb.go	55.23% <55.23%> (ø)
stdlib/sql/from.go	33.65% <100.00%> (+1.30%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 57a7373...1c09486. Read the comment docs.

[wolffcm]

Overall, looks great as usual, I just had some questions.

[wolffcm]

I'm a little worried that someone could craft a table name that contains characters like '; ... or something and do something nefarious. example

Do you have any thoughts on this? For some of the places where we use %s I imagine that we could use parameters ? instead?

[alespour]

I could not get ? placeholder to work with the SQL DO script (SQL Error 1287 - identifier must be declared), but I at least changed it to use declared variables for schema and table. I hope it is safer now...

The resulting query now looks like eg.

DO
BEGIN
    DECLARE SCHEMA_NAME NVARCHAR(11) = 'bike_stores';
    DECLARE TABLE_NAME NVARCHAR(5) = 'xcopy';
    DECLARE X_EXISTS INT = 0;
    SELECT COUNT(*) INTO X_EXISTS FROM TABLES WHERE SCHEMA_NAME=UPPER(:SCHEMA_NAME) AND TABLE_NAME=UPPER(:TABLE_NAME);
    IF :X_EXISTS = 0
    THEN
        CREATE TABLE bike_stores.xcopy (NOTE NVARCHAR(5000),...);
    END IF;
END;

[wolffcm]

I think this is better but it still seems like the CREATE TABLE statement allows for an injection.

If I were to do something like sql.to(table: "foo (i INTEGER); DROP TABLE bar; ..."), then there's still a problem, if I'm understanding right.

What if you always quoted the identifiers in the CREATE TABLE statement:

CREATE TABLE "bike_stores"."xcopy" ("NOTE" NVARCHAR(5000),...);

And if any of the identifiers contain a ", you can either escape it, or produce a user error. Does that make sense?

[alespour]

Improved, I hope :) Since by default object names are converted to uppercase by HDB unless quoted, and quotes are used to escape possibly malign SQL code here and not to mark the value as case-sensitive, uppercase is assumed and used for new output table name, which I think is conforming and safe.

Table created like bellow then allows a user to insert data both with any of the following statements:

INSERT INTO bike_stores.orders_copy_q2 ... (note, ...) VALUES (...)
INSERT INTO BIKE_STORES.ORDERS_COPY_Q2 ... (NOTE, ...) VALUES (...).
INSERT INTO "BIKE_STORES"."ORDERS_COPY_Q2" ... ("NOTE", ...) VALUES (...).

The if-not-exist-then-create now looks like this:

BEGIN
    DECLARE SCHEMA_NAME NVARCHAR(11) = 'BIKE_STORES';
    DECLARE TABLE_NAME NVARCHAR(14) = 'ORDERS_COPY_Q2';
    DECLARE X_EXISTS INT = 0;
    SELECT COUNT(*) INTO X_EXISTS FROM TABLES WHERE SCHEMA_NAME=ESCAPE_DOUBLE_QUOTES(:SCHEMA_NAME) AND TABLE_NAME=ESCAPE_DOUBLE_QUOTES(:TABLE_NAME);
    IF :X_EXISTS = 0
    THEN
        CREATE TABLE "BIKE_STORES"."ORDERS_COPY_Q2" ("NOTE" NVARCHAR(5000),...);
    END IF;
END;

[wolffcm]

This is much better. Thanks for the attention to this.