mirrors
/
postgres
mirror of https://github.com/postgres/postgres
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixes additional sql injection vulnerabilities reported by Oliver Jowett 

and Dmitry Tkach.  Specifically the previous fix still allowed the statement termination character through in unquoted places in the sql statement, and the driver never correctly handled someone passing a value of \0 in a string which under the v2 protocol would end the statement causing the following text to possibly
be treated as a new sql statement
 Modified Files:
 	jdbc/org/postgresql/Driver.java.in
 	jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java
This commit is contained in:
Barry Lind 2003-07-24 00:30:39 +00:00
parent 47f14e7ddf
commit a7a012d167
2 changed files with 21 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/interfaces/jdbc/org/postgresql/Driver.java.in
View File

@ -6,7 +6,7 @@
* Copyright (c) 2003, PostgreSQL Global Development Group
*
* IDENTIFICATION
* $Header: /cvsroot/pgsql/src/interfaces/jdbc/org/postgresql/Attic/Driver.java.in,v 1.33 2003/07/22 05:17:09 barry Exp $
* $Header: /cvsroot/pgsql/src/interfaces/jdbc/org/postgresql/Attic/Driver.java.in,v 1.34 2003/07/24 00:30:38 barry Exp $
*
*-------------------------------------------------------------------------
*/
@ -503,6 +503,6 @@ public class Driver implements java.sql.Driver
//The build number should be incremented for every new build
private static int m_buildNumber = 207;
private static int m_buildNumber = 208;
}

26
src/interfaces/jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java
View File

@ -25,7 +25,7 @@ import java.sql.Timestamp;
import java.sql.Types;
import java.util.Vector;
/* $Header: /cvsroot/pgsql/src/interfaces/jdbc/org/postgresql/jdbc1/Attic/AbstractJdbc1Statement.java,v 1.28 2003/07/22 05:17:09 barry Exp $
/* $Header: /cvsroot/pgsql/src/interfaces/jdbc/org/postgresql/jdbc1/Attic/AbstractJdbc1Statement.java,v 1.29 2003/07/24 00:30:39 barry Exp $
* This class defines methods of the jdbc1 specification. This class is
* extended by org.postgresql.jdbc2.AbstractJdbc2Statement which adds the jdbc2
* methods. The real Statement class (for jdbc1) is org.postgresql.jdbc1.Jdbc1Statement
@ -1036,7 +1036,7 @@ public abstract class AbstractJdbc1Statement implements BaseStatement
sbuf.setLength(0);
sbuf.ensureCapacity(x.length() + (int)(x.length() / 10));
sbuf.append('\'');
escapeString(x, sbuf);
escapeString(x, sbuf, true);
sbuf.append('\'');
bind(parameterIndex, sbuf.toString(), type);
}
@ -1050,18 +1050,30 @@ public abstract class AbstractJdbc1Statement implements BaseStatement
{
sbuf.setLength(0);
sbuf.ensureCapacity(p_input.length());
escapeString(p_input, sbuf);
escapeString(p_input, sbuf, false);
return sbuf.toString();
}
}
private void escapeString(String p_input, StringBuffer p_output) {
private void escapeString(String p_input, StringBuffer p_output, boolean p_allowStatementTerminator) {
for (int i = 0 ; i < p_input.length() ; ++i)
{
char c = p_input.charAt(i);
if (c == '\\' || c == '\'')
p_output.append((char)'\\');
p_output.append(c);
switch (c)
{
case '\\':
case '\'':
p_output.append('\\');
p_output.append(c);
break;
case '\0':
throw new IllegalArgumentException("\\0 not allowed");
case ';':
if (!p_allowStatementTerminator)
throw new IllegalArgumentException("semicolon not allowed");
default:
p_output.append(c);
}
}
}