Ensembia/occweb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Also unquote a function name followed by a comment

Browse Source 
SELECT "pg_read_file" /* x */ ('/etc/passwd') still passed: the check
for a following parenthesis only skipped whitespace. Skip comments too.
This commit is contained in:
Dillard Blom
2026-09-30 17:45:09 +02:00
parent 839572f1fb
commit 93221b2905
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/Service/SqlGuard.php
+1 -1
View File
@@ -124,7 +124,7 @@ class SqlGuard
$end = self::literalEnd($sql, $i); $end = self::literalEnd($sql, $i);
if ($end !== null) { if ($end !== null) {
$literal = substr($sql, $i, $end - $i); $literal = substr($sql, $i, $end - $i);
if (preg_match('/^"([A-Za-z_][A-Za-z0-9_$]*)"$/', $literal, $m) && preg_match('/\G\s*\(/', $sql, $unused, 0, $end)) { if (preg_match('/^"([A-Za-z_][A-Za-z0-9_$]*)"$/', $literal, $m) && preg_match('/\G(?:\s|--[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*\(/', $sql, $unused, 0, $end)) {
// A quoted function name ("setval"(...)) calls the same // A quoted function name ("setval"(...)) calls the same
// function as the bare word, so check it as one // function as the bare word, so check it as one
$result .= $m[1]; $result .= $m[1];
tests/Unit/Service/SqlGuardTest.php
+3
View File
@@ -26,6 +26,8 @@ class SqlGuardTest extends TestCase
["SELECT dblink_exec('host=x', 'DROP TABLE t')"], ["SELECT dblink_exec('host=x', 'DROP TABLE t')"],
["SELECT \"pg_read_file\"('/etc/passwd')"], ["SELECT \"pg_read_file\"('/etc/passwd')"],
["SELECT pg_catalog.\"pg_read_file\"('/etc/passwd')"], ["SELECT pg_catalog.\"pg_read_file\"('/etc/passwd')"],
["SELECT \"pg_read_file\" /* x */ ('/etc/passwd')"],
["SELECT \"pg_read_file\"-- x\n('/etc/passwd')"],
["SELECT dblink_send_query('c', 'SELECT 1')"], ["SELECT dblink_send_query('c', 'SELECT 1')"],
["SELECT * FROM dblink('host=x', 'SELECT 1') AS t(a int)"], ["SELECT * FROM dblink('host=x', 'SELECT 1') AS t(a int)"],
["SELECT * FROM t INTO OUTFILE '/tmp/x'"], ["SELECT * FROM t INTO OUTFILE '/tmp/x'"],
@@ -127,6 +129,7 @@ class SqlGuardTest extends TestCase
["SELECT \"setval\"('seq', 1)"], ["SELECT \"setval\"('seq', 1)"],
["SELECT pg_catalog.\"setval\"('seq', 1)"], ["SELECT pg_catalog.\"setval\"('seq', 1)"],
["SELECT pg_catalog.setval('seq', 1)"], ["SELECT pg_catalog.setval('seq', 1)"],
["SELECT \"setval\" /* x */ ('seq', 1)"],
['MERGE INTO t USING s ON true WHEN MATCHED THEN DELETE'], ['MERGE INTO t USING s ON true WHEN MATCHED THEN DELETE'],
['VACUUM'], ['VACUUM'],
['PRAGMA journal_mode = WAL'], ['PRAGMA journal_mode = WAL'],