Changeset 508

Timestamp:

05/09/13 16:10:50 (12 years ago)

Author:

Kris Deugau

Message:

/trunk

Add some extra fencing aroung the sortorder and sortby arguments to
various get*List methods to prevent SQL injection attacks. See #30.

File:

• trunk/DNSDB.pm (modified) (5 diffs)

trunk/DNSDB.pm

@@ -2591 +2591 @@
 
   # protection against bad or missing arguments
-  $args{sortorder} = 'ASC' if !$args{sortorder};
+  $args{sortorder} = 'ASC' if !$args{sortorder} || !grep /^$args{sortorder}$/, ('ASC','DESC');
+  $args{sortby} = 'group' if !$args{sortby} || $args{sortby} !~ /^[\w_.]+$/;
   $args{offset} = 0 if !$args{offset} || $args{offset} !~ /^(?:all|\d+)$/;
 
@@ -2826 +2827 @@
 
   # protection against bad or missing arguments
-  $args{sortorder} = 'ASC' if !$args{sortorder};
-  $args{sortby} = 'u.username' if !$args{sortby};
+  $args{sortorder} = 'ASC' if !$args{sortorder} || !grep /^$args{sortorder}$/, ('ASC','DESC');
+  $args{sortby} = 'u.username' if !$args{sortby} || $args{sortby} !~ /^[\w_.]+$/;
   $args{offset} = 0 if !$args{offset} || $args{offset} !~ /^(?:all|\d+)$/;
 
@@ -3293 +3294 @@
 
   # protection against bad or missing arguments
-  $args{sortorder} = 'ASC' if !$args{sortorder};
-  $args{sortby} = 'l.description' if !$args{sortby};
+  $args{sortorder} = 'ASC' if !$args{sortorder} || !grep /^$args{sortorder}$/, ('ASC','DESC');
+  $args{sortby} = 'l.description' if !$args{sortby} || $args{sortby} !~ /^[\w_.]+$/;
   $args{offset} = 0 if !$args{offset} || $args{offset} !~ /^(?:all|\d+)$/;
 
@@ -3495 +3496 @@
 
   # protection against bad or missing arguments
-  $args{sortorder} = 'ASC' if !$args{sortorder};
-  $args{sortby} = 'host' if !$args{sortby} && $args{revrec} eq 'n';     # default sort by host on domain record list
-  $args{sortby} = 'val' if !$args{sortby} && $args{revrec} eq 'y';      # default sort by IP on revzone record list
+  $args{sortorder} = 'ASC' if !$args{sortorder} || !grep /^$args{sortorder}$/, ('ASC','DESC');
+  my $defsort = 'host' if $args{revrec} eq 'n';     # default sort by host on domain record list
+  my $defsort = 'val' if $args{revrec} eq 'y';      # default sort by IP on revzone record list
+  $args{sortby} = $defsort if !$args{revrec};
+  $args{sortby} = $defsort if $args{sortby} !~ /^[\w_.]+$/;
   $args{offset} = 0 if !$args{offset} || $args{offset} !~ /^(?:all|\d+)$/;  
   my $perpage = ($args{nrecs} ? $args{nrecs} : $config{perpage});
@@ -4051 +4054 @@
 
   # Sorting defaults
-  $args{sortby} = 'stamp' if !$args{sortby};
-  $args{sortorder} = 'DESC' if !$args{sortorder};
+  $args{sortorder} = 'DESC' if !$args{sortorder} || !grep /^$args{sortorder}$/, ('ASC','DESC');
+  $args{sortby} = 'stamp' if !$args{sortby} || $args{sortby} !~ /^[\w_.]+$/;
   $args{offset} = 0 if !$args{offset} || $args{offset} !~ /^(?:all|\d+)$/;