dillard
f68b1658be
A security review found three issues: - Comments were removed without a space before matching the forbidden patterns, so "TO/**/PROGRAM" became "TOPROGRAM" and passed the COPY ... PROGRAM check while PostgreSQL still ran it. Comments are now replaced by a space, and the COPY file check also covers E'...', U&'...' and dollar-quoted file names. - Only statements starting with DELETE or UPDATE asked for confirmation, so a leading block comment, a data-modifying CTE (WITH x AS (DELETE ...)) or DROP/TRUNCATE/INSERT ran without it. Every statement that is not a plain read now needs confirmation, decided on the server. - occ output could contain escape sequences, backspaces and URLs from user-controlled text (display names, file names) that rewrite or hide text or show a clickable link. Only color codes are kept now, and URLs are no longer turned into links. The checks move to SqlGuard so they can be tested on their own. They remain defense in depth: dynamic SQL can always get around a text check, so the database role should not have superuser rights, pg_execute_server_program or pg_read/write_server_files. A read that starts with WITH now shows its rows like a SELECT.
330 lines
13 KiB
PHP
330 lines
13 KiB
PHP
<?php
|
|
|
|
namespace OCA\OCCWeb\Controller;
|
|
|
|
use OC;
|
|
use OCA\OCCWeb\Service\SqlGuard;
|
|
use OCP\AppFramework\Controller;
|
|
use OCP\IRequest;
|
|
use OCP\IDBConnection;
|
|
use OCP\AppFramework\Http\JSONResponse;
|
|
use OCP\IGroupManager;
|
|
use OCP\IUserSession;
|
|
use Psr\Log\LoggerInterface;
|
|
|
|
class DbController extends Controller
|
|
{
|
|
/** Maximum rows returned per SELECT (protection against OOM/DoS). */
|
|
private const MAX_ROWS = 1000;
|
|
|
|
/** Maximum size of submitted SQL text in bytes (protection against OOM/DoS). */
|
|
private const MAX_SQL_BYTES = 1048576; // 1 MB
|
|
|
|
private $db;
|
|
private $groupManager;
|
|
private $userSession;
|
|
private $logger;
|
|
|
|
public function __construct(
|
|
$AppName,
|
|
IRequest $request,
|
|
IDBConnection $db,
|
|
IGroupManager $groupManager,
|
|
IUserSession $userSession
|
|
) {
|
|
parent::__construct($AppName, $request);
|
|
$this->db = $db;
|
|
$this->groupManager = $groupManager;
|
|
$this->userSession = $userSession;
|
|
// Via OC::$server, same as in OccController — we don't add LoggerInterface
|
|
// to the constructor so as not to change the signature resolved by the DI container.
|
|
$this->logger = OC::$server->get(LoggerInterface::class);
|
|
}
|
|
|
|
/**
|
|
* Splits a batch of queries on ";" while respecting single and double
|
|
* quotes (strings and Postgres-escaped identifiers), so that a
|
|
* semicolon inside a 'string' or "identifier" (including '' / "" as
|
|
* an escaped quote) doesn't break up the split.
|
|
*/
|
|
private function splitStatements($sql)
|
|
{
|
|
$statements = [];
|
|
$current = '';
|
|
$len = strlen($sql);
|
|
$quoteChar = null;
|
|
|
|
for ($i = 0; $i < $len; $i++) {
|
|
$ch = $sql[$i];
|
|
|
|
if ($quoteChar !== null) {
|
|
if ($ch === $quoteChar) {
|
|
if ($i + 1 < $len && $sql[$i + 1] === $quoteChar) {
|
|
$current .= $quoteChar . $quoteChar;
|
|
$i++;
|
|
continue;
|
|
}
|
|
$quoteChar = null;
|
|
}
|
|
$current .= $ch;
|
|
continue;
|
|
}
|
|
|
|
if ($ch === "'" || $ch === '"') {
|
|
$quoteChar = $ch;
|
|
$current .= $ch;
|
|
continue;
|
|
}
|
|
|
|
if ($ch === ';') {
|
|
$statements[] = trim($current);
|
|
$current = '';
|
|
continue;
|
|
}
|
|
|
|
$current .= $ch;
|
|
}
|
|
|
|
if (trim($current) !== '') {
|
|
$statements[] = trim($current);
|
|
}
|
|
|
|
return array_values(array_filter($statements, function ($s) {
|
|
return $s !== '';
|
|
}));
|
|
}
|
|
|
|
public function query()
|
|
{
|
|
// Deliberate defense-in-depth (see the equivalent check in
|
|
// OccController::requireAdmin() for why it's kept even though
|
|
// Nextcloud's SecurityMiddleware already enforces this by default
|
|
// absent @NoAdminRequired) - this one is also the direct fix for
|
|
// this controller having shipped with @PublicPage originally,
|
|
// which did bypass that default protection entirely.
|
|
$user = $this->userSession->getUser();
|
|
if (!$user) {
|
|
return new JSONResponse(['error' => 'Not authenticated'], 401);
|
|
}
|
|
|
|
if (!$this->groupManager->isAdmin($user->getUID())) {
|
|
return new JSONResponse(['error' => 'Admin privileges required'], 403);
|
|
}
|
|
|
|
$sql = $this->request->getParam('sql', '');
|
|
$confirmed = filter_var($this->request->getParam('confirm', false), FILTER_VALIDATE_BOOLEAN);
|
|
|
|
if (empty(trim($sql))) {
|
|
return new JSONResponse(['success' => false, 'error' => 'Empty query']);
|
|
}
|
|
|
|
if (strlen($sql) > self::MAX_SQL_BYTES) {
|
|
return new JSONResponse([
|
|
'success' => false,
|
|
'error' => 'Query too large (max ' . self::MAX_SQL_BYTES . ' bytes)'
|
|
], 413);
|
|
}
|
|
|
|
// Audit: log the fact that execution was attempted BEFORE any checks,
|
|
// so blocked/rejected queries are recorded in the log too, not just
|
|
// the ones that succeeded.
|
|
$this->logger->warning('[extended_occweb] SQL submitted by {user}: {sql}', [
|
|
'app' => 'extended_occweb',
|
|
'user' => $user->getUID(),
|
|
'sql' => $sql,
|
|
]);
|
|
|
|
// Split the batch on ";" respecting quotes (see splitStatements).
|
|
// All queries run sequentially on the same DB connection (within a
|
|
// single HTTP request), so SET retains its value for
|
|
// current_setting() in the following queries of the same batch.
|
|
$queries = $this->splitStatements($sql);
|
|
|
|
// Access to the server's filesystem / running programs via SQL is
|
|
// blocked entirely — this isn't about data loss (like DELETE), it's
|
|
// about potential server takeover, and confirmation doesn't bypass it.
|
|
foreach ($queries as $query) {
|
|
$forbidden = SqlGuard::findForbiddenConstruct($query);
|
|
if ($forbidden !== null) {
|
|
$this->logger->error('[extended_occweb] Blocked forbidden construct ({construct}) from {user}: {sql}', [
|
|
'app' => 'extended_occweb',
|
|
'construct' => $forbidden,
|
|
'user' => $user->getUID(),
|
|
'sql' => $sql,
|
|
]);
|
|
return new JSONResponse([
|
|
'success' => false,
|
|
'error' => "Query blocked: contains a forbidden construct ({$forbidden}). File/program access via SQL is not allowed."
|
|
]);
|
|
}
|
|
}
|
|
|
|
// Anything that isn't a plain read (DELETE, UPDATE, INSERT, DROP,
|
|
// a data-modifying CTE, ...) needs explicit confirmation from the
|
|
// client (confirm=true) before a single query of the batch runs.
|
|
$writeTypes = [];
|
|
foreach ($queries as $query) {
|
|
if (!SqlGuard::isReadOnly($query)) {
|
|
$type = SqlGuard::statementType($query) ?: 'UNKNOWN';
|
|
$writeTypes[$type] = ($writeTypes[$type] ?? 0) + 1;
|
|
}
|
|
}
|
|
|
|
if ($writeTypes !== [] && !$confirmed) {
|
|
$parts = [];
|
|
foreach ($writeTypes as $type => $count) {
|
|
$parts[] = "{$count} {$type}";
|
|
}
|
|
return new JSONResponse([
|
|
'success' => false,
|
|
'requiresConfirmation' => true,
|
|
'deleteCount' => $writeTypes['DELETE'] ?? 0,
|
|
'updateCount' => $writeTypes['UPDATE'] ?? 0,
|
|
'writeCount' => array_sum($writeTypes),
|
|
'error' => 'Batch contains statement(s) that change data or the schema (' . implode(', ', $parts) . ') and was not executed. Resend with confirm=true to proceed.'
|
|
]);
|
|
}
|
|
|
|
// The batch runs inside a single transaction: if one of the queries
|
|
// fails (e.g. a DELETE partway through a series due to an FK), all
|
|
// changes already made within this same batch are rolled back instead
|
|
// of staying partially applied. SET (without LOCAL) isn't
|
|
// transactional in PostgreSQL, so the rollback doesn't affect
|
|
// current_setting().
|
|
//
|
|
// About DDL: in PostgreSQL (our database) DDL — CREATE/ALTER/DROP
|
|
// TABLE etc. — is fully transactional and rolls back together with
|
|
// the rest of the batch's changes, so there's no problem here for
|
|
// Postgres. But Nextcloud also works with MySQL/MariaDB through the
|
|
// same IDBConnection, and there DDL causes an implicit COMMIT — if
|
|
// this batch runs on a MySQL instance, commit()/rollBack() after such
|
|
// a DDL statement will get a "no active transaction" exception. We
|
|
// wrap begin/commit/rollBack in try/catch so this doesn't turn into
|
|
// an unhandled exception and an HTTP 500 instead of a clean JSON
|
|
// response.
|
|
$results = [];
|
|
$rolledBack = false;
|
|
$rollbackFailed = false;
|
|
$transactionStarted = false;
|
|
|
|
try {
|
|
$this->db->beginTransaction();
|
|
$transactionStarted = true;
|
|
} catch (\Exception $e) {
|
|
$this->logger->warning('[extended_occweb] beginTransaction() failed, proceeding without an explicit transaction: {error}', [
|
|
'app' => 'extended_occweb',
|
|
'error' => $e->getMessage(),
|
|
]);
|
|
}
|
|
|
|
foreach ($queries as $query) {
|
|
$statementType = SqlGuard::statementType($query);
|
|
$isSet = $statementType === 'SET';
|
|
$isDelete = $statementType === 'DELETE';
|
|
$isUpdate = $statementType === 'UPDATE';
|
|
|
|
try {
|
|
$stmt = $this->db->prepare($query);
|
|
$stmt->execute();
|
|
|
|
if ($statementType === 'SELECT' || ($statementType === 'WITH' && SqlGuard::isReadOnly($query))) {
|
|
// Read row by row and stop at MAX_ROWS, instead of
|
|
// fetchAll() + array_slice — otherwise a SELECT without
|
|
// LIMIT on a huge table would still pull everything into
|
|
// PHP memory.
|
|
$rows = [];
|
|
$truncated = false;
|
|
while (($row = $stmt->fetch()) !== false) {
|
|
if (count($rows) >= self::MAX_ROWS) {
|
|
$truncated = true;
|
|
break;
|
|
}
|
|
$rows[] = $row;
|
|
}
|
|
$results[] = [
|
|
'query' => $query,
|
|
'type' => 'select',
|
|
'count' => count($rows),
|
|
'truncated' => $truncated,
|
|
'data' => $rows
|
|
];
|
|
} else {
|
|
$affected = $stmt->rowCount();
|
|
if ($isSet) {
|
|
$type = 'set';
|
|
} elseif ($isDelete) {
|
|
$type = 'delete';
|
|
} elseif ($isUpdate) {
|
|
$type = 'update';
|
|
} else {
|
|
$type = 'write';
|
|
}
|
|
$results[] = [
|
|
'query' => $query,
|
|
'type' => $type,
|
|
'affected_rows' => $affected
|
|
];
|
|
}
|
|
} catch (\Exception $e) {
|
|
$results[] = [
|
|
'query' => $query,
|
|
'type' => 'error',
|
|
'error' => $e->getMessage()
|
|
];
|
|
// Roll back the whole batch and stop: don't keep executing
|
|
// the remaining queries (e.g. a series of DELETEs) if one of
|
|
// the preceding steps failed.
|
|
if ($transactionStarted) {
|
|
try {
|
|
$this->db->rollBack();
|
|
$rolledBack = true;
|
|
} catch (\Exception $rollbackError) {
|
|
// The transaction was already closed by something
|
|
// other than us — e.g. an implicit COMMIT from a DDL
|
|
// statement on MySQL/MariaDB. Anything that executed
|
|
// BEFORE this point in the batch may remain
|
|
// permanently applied — we deliberately do NOT set
|
|
// rolledBack to true, since that would be untrue.
|
|
$rollbackFailed = true;
|
|
$this->logger->warning('[extended_occweb] rollBack() failed after an error — earlier statements in this batch may already be permanently applied: {error}', [
|
|
'app' => 'extended_occweb',
|
|
'error' => $rollbackError->getMessage(),
|
|
]);
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!$rolledBack && !$rollbackFailed && $transactionStarted) {
|
|
try {
|
|
$this->db->commit();
|
|
} catch (\Exception $e) {
|
|
// The transaction was already committed implicitly (e.g. by
|
|
// a DDL statement on MySQL/MariaDB) — the effects are
|
|
// already saved, this isn't an error in executing the batch
|
|
// itself.
|
|
$this->logger->info('[extended_occweb] commit() had nothing to commit (likely auto-committed by a DDL statement): {error}', [
|
|
'app' => 'extended_occweb',
|
|
'error' => $e->getMessage(),
|
|
]);
|
|
}
|
|
}
|
|
|
|
$response = [
|
|
'success' => true,
|
|
'rolledBack' => $rolledBack,
|
|
'results' => $results
|
|
];
|
|
|
|
if ($rollbackFailed) {
|
|
$response['rollbackFailed'] = true;
|
|
$response['warning'] = 'The batch failed partway through and the rollback itself failed (this can happen if an earlier '
|
|
. 'statement, e.g. a DDL statement, implicitly committed on this database backend). Statements executed before the '
|
|
. 'failure may have been permanently applied — check the results above and verify manually.';
|
|
}
|
|
|
|
return new JSONResponse($response);
|
|
}
|
|
}
|