Skip to content

bk: фикс безопасности инъекции через fields #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bkeenke wants to merge 1 commit into
base: master
Choose a base branch
from
Open

bk: фикс безопасности инъекции через fields #111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions app/lib/Core/Sql/Data.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -757,19 +757,20 @@ sub list_for_api {
my $method = $args{admin} ? '_list' : 'list';

# Validate fields against structure to prevent SELECT injection.
# Complex expressions (containing SQL syntax like parentheses, wildcards or dots)
# are treated as trusted internal code and passed through unchanged.
# Trust is decided by the CLASS (trusted_fields_passthrough), never by the
# shape of the value itself - `fields` may come straight from an HTTP query
# string, so a class must opt in explicitly (and must guarantee it never
# forwards a client-supplied `fields` value unchanged) to bypass sanitizing.
my $fields;
if ( $args{fields} && $args{fields} ne '*' && $self->can('structure') ) {
if ( $args{fields} =~ /[().*]/ ) {
# Internal trusted SQL expression — pass through unchanged
if ( $self->can('trusted_fields_passthrough') && $self->trusted_fields_passthrough ) {
$fields = $args{fields};
} else {
my %structure = %{ $self->structure };
my @safe = grep { exists $structure{$_} } split /\s*,\s*/, $args{fields};
$fields = @safe ? join(', ', map { "`$_`" } @safe) : undef;
}
} elsif ( $args{fields} ) {
} elsif ( $args{fields} && ( $args{fields} eq '*' || !$self->can('structure') ) ) {
$fields = $args{fields};
}

Expand Down
2 changes: 2 additions & 0 deletions app/lib/Core/USObject.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,8 @@ sub _list {
return $self->SUPER::_list( %args );
}

sub trusted_fields_passthrough { return 1 }

sub list_for_api {
my $self = shift;
my %args = (
Expand Down