Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitacf09c6

Browse files
author
Barry Lind
committed
Sometimes the third time is the charm. Third try to fix the sql injection
vulnerability. This fix completely removes the ability (hack) of being ableto bind a list of values in an in clause. It was demonstrated that by allowingthat functionality you open up the possibility for certain types ofsql injection attacks. The previous fix attempts all focused on preventingthe insertion of additional sql statements (the semi-colon problem:xxx; any new sql statement here). But that still left the ability tochange the where clause on the current statement or perform a subselectwhich can circumvent applicaiton security logic and/or allow you to callany stored function. Modified Files: jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java
1 parentf0f1375 commitacf09c6

File tree

1 file changed

+17
-20
lines changed

1 file changed

+17
-20
lines changed

‎src/interfaces/jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java

Lines changed: 17 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
importjava.sql.Types;
2626
importjava.util.Vector;
2727

28-
/* $Header: /cvsroot/pgsql/src/interfaces/jdbc/org/postgresql/jdbc1/Attic/AbstractJdbc1Statement.java,v 1.29 2003/07/24 00:30:39 barry Exp $
28+
/* $Header: /cvsroot/pgsql/src/interfaces/jdbc/org/postgresql/jdbc1/Attic/AbstractJdbc1Statement.java,v 1.30 2003/08/07 04:03:13 barry Exp $
2929
* This class defines methods of the jdbc1 specification. This class is
3030
* extended by org.postgresql.jdbc2.AbstractJdbc2Statement which adds the jdbc2
3131
* methods. The real Statement class (for jdbc1) is org.postgresql.jdbc1.Jdbc1Statement
@@ -1036,26 +1036,14 @@ public void setString(int parameterIndex, String x, String type) throws SQLExcep
10361036
sbuf.setLength(0);
10371037
sbuf.ensureCapacity(x.length() + (int)(x.length() /10));
10381038
sbuf.append('\'');
1039-
escapeString(x,sbuf,true);
1039+
escapeString(x,sbuf);
10401040
sbuf.append('\'');
10411041
bind(parameterIndex,sbuf.toString(),type);
10421042
}
10431043
}
10441044
}
10451045

1046-
privateStringescapeString(Stringp_input) {
1047-
// use the shared buffer object. Should never clash but this makes
1048-
// us thread safe!
1049-
synchronized (sbuf)
1050-
{
1051-
sbuf.setLength(0);
1052-
sbuf.ensureCapacity(p_input.length());
1053-
escapeString(p_input,sbuf,false);
1054-
returnsbuf.toString();
1055-
}
1056-
}
1057-
1058-
privatevoidescapeString(Stringp_input,StringBufferp_output,booleanp_allowStatementTerminator) {
1046+
privatevoidescapeString(Stringp_input,StringBufferp_output) {
10591047
for (inti =0 ;i <p_input.length() ; ++i)
10601048
{
10611049
charc =p_input.charAt(i);
@@ -1068,9 +1056,6 @@ private void escapeString(String p_input, StringBuffer p_output, boolean p_allow
10681056
break;
10691057
case'\0':
10701058
thrownewIllegalArgumentException("\\0 not allowed");
1071-
case';':
1072-
if (!p_allowStatementTerminator)
1073-
thrownewIllegalArgumentException("semicolon not allowed");
10741059
default:
10751060
p_output.append(c);
10761061
}
@@ -1493,8 +1478,14 @@ public void setObject(int parameterIndex, Object x, int targetSqlType, int scale
14931478
caseTypes.INTEGER:
14941479
if (xinstanceofBoolean)
14951480
bind(parameterIndex,((Boolean)x).booleanValue() ?"1" :"0",PG_BOOLEAN);
1481+
elseif (xinstanceofInteger ||xinstanceofLong ||
1482+
xinstanceofDouble ||xinstanceofShort ||
1483+
xinstanceofNumber ||xinstanceofFloat )
1484+
bind(parameterIndex,x.toString(),PG_INTEGER);
14961485
else
1497-
bind(parameterIndex,escapeString(x.toString()),PG_INTEGER);
1486+
//ensure the value is a valid numeric value to avoid
1487+
//sql injection attacks
1488+
bind(parameterIndex,newBigDecimal(x.toString()).toString(),PG_INTEGER);
14981489
break;
14991490
caseTypes.TINYINT:
15001491
caseTypes.SMALLINT:
@@ -1506,8 +1497,14 @@ public void setObject(int parameterIndex, Object x, int targetSqlType, int scale
15061497
caseTypes.NUMERIC:
15071498
if (xinstanceofBoolean)
15081499
bind(parameterIndex, ((Boolean)x).booleanValue() ?"1" :"0",PG_BOOLEAN);
1500+
elseif (xinstanceofInteger ||xinstanceofLong ||
1501+
xinstanceofDouble ||xinstanceofShort ||
1502+
xinstanceofNumber ||xinstanceofFloat )
1503+
bind(parameterIndex,x.toString(),PG_NUMERIC);
15091504
else
1510-
bind(parameterIndex,escapeString(x.toString()),PG_NUMERIC);
1505+
//ensure the value is a valid numeric value to avoid
1506+
//sql injection attacks
1507+
bind(parameterIndex,newBigDecimal(x.toString()).toString(),PG_NUMERIC);
15111508
break;
15121509
caseTypes.CHAR:
15131510
caseTypes.VARCHAR:

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp