Address SQL injection vulnerability in SQL ORM layer

If the user-supplied value and the db column are both numbers
(jsonObject->type == JSON_NUMBER, get_primitive(field) == "number") then
don't quote. Otherwise, quote.

Signed-off-by: Mike Rylander <mrylander@gmail.com>
Signed-off-by: Dan Scott <dscott@laurentian.ca>
Signed-off-by: Mike Rylander <mrylander@gmail.com>

diff --git a/Open-ILS/src/c-apps/oils_sql.c b/Open-ILS/src/c-apps/oils_sql.c
index c67362b..ea614e1 100644 (file)
--- a/Open-ILS/src/c-apps/oils_sql.c
+++ b/Open-ILS/src/c-apps/oils_sql.c
@@ -2460,8 +2460,7 @@ int doRetrieve( osrfMethodContext* ctx ) {
        @return Pointer to a newly allocated string.
 
        The input object is typically a JSON_NUMBER, but it may be a JSON_STRING as long as
        @return Pointer to a newly allocated string.
 
        The input object is typically a JSON_NUMBER, but it may be a JSON_STRING as long as

-       its contents are numeric.  A non-numeric string is likely to result in invalid SQL,
-       or (what is worse) valid SQL that is wrong.
+       its contents are numeric.  A non-numeric string is likely to result in invalid SQL.

 
        If the datatype of the receiving field is not numeric, wrap the value in quotes.
 
 
        If the datatype of the receiving field is not numeric, wrap the value in quotes.
 


@@ -2471,22 +2470,9 @@ static char* jsonNumberToDBString( osrfHash* field, const jsonObject* value ) {
        growing_buffer* val_buf = buffer_init( 32 );
        const char* numtype = get_datatype( field );
 
        growing_buffer* val_buf = buffer_init( 32 );
        const char* numtype = get_datatype( field );
 

-       // For historical reasons the following contains cruft that could be cleaned up.
-       if( !strncmp( numtype, "INT", 3 ) ) {
-               if( value->type == JSON_NUMBER )
-                       //buffer_fadd( val_buf, "%ld", (long)jsonObjectGetNumber(value) );
-                       buffer_fadd( val_buf, jsonObjectGetString( value ) );
-               else {
-                       buffer_fadd( val_buf, jsonObjectGetString( value ) );
-               }
-
-       } else if( !strcmp( numtype, "NUMERIC" )) {
-               if( value->type == JSON_NUMBER )
-                       buffer_fadd( val_buf, jsonObjectGetString( value ));
-               else {
-                       buffer_fadd( val_buf, jsonObjectGetString( value ));
-               }
-
+    // If the value is a number and the DB field is numeric, no quotes needed
+       if( value->type == JSON_NUMBER && !strcmp( get_primitive( field ), "number") ) {
+               buffer_fadd( val_buf, jsonObjectGetString( value ) );

        } else {
                // Presumably this was really intended to be a string, so quote it
                char* str = jsonObjectToSimpleString( value );
        } else {
                // Presumably this was really intended to be a string, so quote it
                char* str = jsonObjectToSimpleString( value );