albert/mrfrys-node-server
1
0
Fork 0
mirror of https://gitlab.com/MrFry/mrfrys-node-server synced 2025-04-01 20:24:18 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sql injection fixes

Browse source
This commit is contained in:
mrfry 2022-03-20 08:01:10 +01:00
parent 799930b3e1
commit 3fe01eec9b
3 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/modules/api/submodules/chat.ts
View file

@ -131,7 +131,7 @@ function setup(data: SubmoduleData): void {
const msgObj = { const msgObj = {
sender: userid, sender: userid,
reciever: parseInt(reciever), reciever: parseInt(reciever),
msg: msg.replace(/'/g, '').replace(/;/g, ''), msg: dbtools.sanitizeQuery(msg),
type: type || 'text', type: type || 'text',
date: new Date().getTime(), date: new Date().getTime(),
unread: 1, unread: 1,

12
src/utils/dbtools.ts
View file

@ -13,6 +13,7 @@ export default {
Insert: Insert, Insert: Insert,
CloseDB: CloseDB, CloseDB: CloseDB,
runStatement: runStatement, runStatement: runStatement,
sanitizeQuery: sanitizeQuery,
} }
import Sqlite from 'better-sqlite3' import Sqlite from 'better-sqlite3'
@ -21,14 +22,21 @@ import utils from '../utils/utils'
const debugLog = process.env.NS_SQL_DEBUG_LOG const debugLog = process.env.NS_SQL_DEBUG_LOG
function sanitizeQuery(val: string): string {
return val.replace(/'/g, '').replace(/;/g, '')
}
// { asd: 'asd', basd: 4 } => asd = 'asd', basd = 4 // { asd: 'asd', basd: 4 } => asd = 'asd', basd = 4
function GetSqlQuerry(conditions: any, type: string, joiner?: string) { function GetSqlQuerry(conditions: any, type: string, joiner?: string) {
const res = Object.keys(conditions).reduce((acc, key) => { const res = Object.keys(conditions).reduce((acc, key) => {
const item = conditions[key] const item = conditions[key]
const conditionKey = sanitizeQuery(key)
const condition = sanitizeQuery(conditions[key])
if (typeof item === 'string') { if (typeof item === 'string') {
acc.push(`${key} = '${conditions[key]}'`) acc.push(`${conditionKey} = '${condition}'`)
} else { } else {
acc.push(`${key} = ${conditions[key]}`) acc.push(`${conditionKey} = ${condition}`)
} }
return acc return acc
}, []) }, [])

2
submodules/qmining-page

@ -1 +1 @@
Subproject commit 2b491e6bec6eee78400e3e042418def12df3243f Subproject commit dd7001023eaf9169863268325c2219ed0822895b