dillard
f68b1658be
A security review found three issues: - Comments were removed without a space before matching the forbidden patterns, so "TO/**/PROGRAM" became "TOPROGRAM" and passed the COPY ... PROGRAM check while PostgreSQL still ran it. Comments are now replaced by a space, and the COPY file check also covers E'...', U&'...' and dollar-quoted file names. - Only statements starting with DELETE or UPDATE asked for confirmation, so a leading block comment, a data-modifying CTE (WITH x AS (DELETE ...)) or DROP/TRUNCATE/INSERT ran without it. Every statement that is not a plain read now needs confirmation, decided on the server. - occ output could contain escape sequences, backspaces and URLs from user-controlled text (display names, file names) that rewrite or hide text or show a clickable link. Only color codes are kept now, and URLs are no longer turned into links. The checks move to SqlGuard so they can be tested on their own. They remain defense in depth: dynamic SQL can always get around a text check, so the database role should not have superuser rights, pg_execute_server_program or pg_read/write_server_files. A read that starts with WITH now shows its rows like a SELECT.
38 lines
1.8 KiB
XML
38 lines
1.8 KiB
XML
<?xml version="1.0"?>
|
|
<info xmlns:xsi= "http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:noNamespaceSchemaLocation="https://apps.nextcloud.com/schema/apps/info.xsd">
|
|
<id>extended_occweb</id>
|
|
<name>Extended OCC Web</name>
|
|
<summary>OCC Commands in a web terminal</summary>
|
|
<description><![CDATA[Run OCC Commands in a web terminal]]></description>
|
|
<version>0.4.5</version>
|
|
<licence>agpl</licence>
|
|
<author mail="dillard.blom@ensembia.com" >Dillard Blom</author>
|
|
<namespace>OCCWeb</namespace>
|
|
<category>tools</category>
|
|
<website>https://github.com/dillardblom/occweb</website>
|
|
<bugs>https://github.com/dillardblom/occweb/issues</bugs>
|
|
<repository>https://github.com/dillardblom/occweb</repository>
|
|
<screenshot>https://github.com/dillardblom/occweb/raw/main/appinfo/screenshot.png</screenshot>
|
|
<dependencies>
|
|
<!-- min-version and max-version must equal the lowest/highest NC core
|
|
versions this fork has actually been verified on (via testbak/,
|
|
see its README) - never inherited from upstream or guessed at
|
|
either end. min-version was 30 pre-testbak, unverified since the
|
|
app-id rename/jQuery fixes - narrowed to 32 (2026-09-27) once 30/31
|
|
turned out to never have been re-tested and 32 was confirmed
|
|
working. Test against the next major's beta and bump max-version
|
|
BEFORE it goes final, so occ:upgrade never has to fall back to
|
|
auto-disabling the app. -->
|
|
<nextcloud min-version="32" max-version="35"/>
|
|
</dependencies>
|
|
<navigations>
|
|
<navigation role="admin">
|
|
<name>OCC Web</name>
|
|
<route>extended_occweb.occ.index</route>
|
|
<icon>app.svg</icon>
|
|
<type>link</type>
|
|
</navigation>
|
|
</navigations>
|
|
</info>
|