fedir/ICFS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed yet another SQL injection bug.

Browse Source
This commit is contained in:
fedir 2025-05-21 19:04:52 +02:00
parent 5c92ece0db
commit 6423e3b2ef
Signed by: fedir
GPG Key ID: C959EE85F0C9362C
1 changed files with 13 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
src/perm_permissions_table.c
View File

@ -291,36 +291,27 @@ access_t check_perm_access(const char *filename, struct process_info pi) {
*/
int set_perm_access(const char *filename, struct process_info pi,
set_mode_t mode) {
char *query = NULL;
int ret = -1;
sqlite3_stmt *stmt = NULL;
char *sql = NULL;
if (mode == SET_ALLOW) {
ret = asprintf(&query, "INSERT INTO %s VALUES (\'%s\', \'%s\', TRUE);",
table_name, pi.name, filename);
sql = "INSERT INTO permissions VALUES (?1, ?2, TRUE);";
} else if (mode == SET_DENY) {
ret = asprintf(&query, "INSERT INTO %s VALUES (\'%s\', \'%s\', FALSE);",
table_name, pi.name, filename);
sql = "INSERT INTO permissions VALUES (?1, ?2, FALSE);";
} else {
return 1;
}
if (ret < 0) {
// If asprintf fails, the contents of query are undefined (see man
// asprintf). That does not explicitly rule out that query will be a valid
// pointer. But the risk of freeing a non-allocated pointer is too much to
// justify preparing for this.
fprintf(stderr, "[ICFS] Could not create query on rule insertion\n");
perror("");
return 1;
}
char *sqlite_error = NULL;
ret = sqlite3_exec(perm_database, query, NULL, NULL, &sqlite_error);
free(query);
if (ret != SQLITE_OK) {
fprintf(stderr, "[ICFS] SQLite returned an error: %s\n", sqlite_error);
sqlite3_free(sqlite_error);
sqlite3_prepare_v2(perm_database, sql, -1, &stmt, NULL);
sqlite3_bind_text(stmt, 1, pi.name, -1, SQLITE_STATIC);
sqlite3_bind_text(stmt, 2, filename, -1, SQLITE_STATIC);
int step_ret = sqlite3_step(stmt);
if (step_ret != SQLITE_DONE) {
fprintf(stderr, "[ICFS] SQLite error: %s\n", sqlite3_errstr(step_ret));
sqlite3_finalize(stmt);
return 1;
}
sqlite3_finalize(stmt);
return 0;
}