fedir/ICFS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed yet another SQL injection bug.

Browse Source
This commit is contained in:
fedir
2025-05-21 19:04:52 +02:00
parent 5c92ece0db
commit 6423e3b2ef
1 changed files with 13 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
src/perm_permissions_table.c
View File

@@ -291,36 +291,27 @@ access_t check_perm_access(const char *filename, struct process_info pi) {
*/ */
int set_perm_access(const char *filename, struct process_info pi, int set_perm_access(const char *filename, struct process_info pi,
set_mode_t mode) { set_mode_t mode) {
char *query = NULL; sqlite3_stmt *stmt = NULL;
int ret = -1; char *sql = NULL;
if (mode == SET_ALLOW) { if (mode == SET_ALLOW) {
ret = asprintf(&query, "INSERT INTO %s VALUES (\'%s\', \'%s\', TRUE);", sql = "INSERT INTO permissions VALUES (?1, ?2, TRUE);";
table_name, pi.name, filename);
} else if (mode == SET_DENY) { } else if (mode == SET_DENY) {
ret = asprintf(&query, "INSERT INTO %s VALUES (\'%s\', \'%s\', FALSE);", sql = "INSERT INTO permissions VALUES (?1, ?2, FALSE);";
table_name, pi.name, filename);
} else { } else {
return 1; return 1;
} }
if (ret < 0) { sqlite3_prepare_v2(perm_database, sql, -1, &stmt, NULL);
// If asprintf fails, the contents of query are undefined (see man sqlite3_bind_text(stmt, 1, pi.name, -1, SQLITE_STATIC);
// asprintf). That does not explicitly rule out that query will be a valid sqlite3_bind_text(stmt, 2, filename, -1, SQLITE_STATIC);
// pointer. But the risk of freeing a non-allocated pointer is too much to int step_ret = sqlite3_step(stmt);
// justify preparing for this. if (step_ret != SQLITE_DONE) {
fprintf(stderr, "[ICFS] Could not create query on rule insertion\n"); fprintf(stderr, "[ICFS] SQLite error: %s\n", sqlite3_errstr(step_ret));
perror(""); sqlite3_finalize(stmt);
return 1;
}
char *sqlite_error = NULL;
ret = sqlite3_exec(perm_database, query, NULL, NULL, &sqlite_error);
free(query);
if (ret != SQLITE_OK) {
fprintf(stderr, "[ICFS] SQLite returned an error: %s\n", sqlite_error);
sqlite3_free(sqlite_error);
return 1; return 1;
} }
sqlite3_finalize(stmt);
return 0; return 0;
} }