remove more special characters from sql query

[whohoho]

There is a bug in etherpad-lite that allows you to download all pads.

They pointed out that this might be a bug in ueberDB.

Here some special characters get removed.
https://github.com/Pita/ueberDB/blob/5c2ef4dc1476ef24bc475885817816c3e602ec8b/mysql_db.js#L133

_ (and possible more) is a special character as well.

See:
https://dev.mysql.com/doc/refman/5.7/en/pattern-matching.html
ether/etherpad-lite#3169

[ghost]

Since the use of pattern matching (MySQL, etc) / regular expressions (dirtydb) may be a wanted behavior, it would be great to implement an escape method for each supported database so clients (eg. etherpad-lite) can apply it on user-controlled data.

[JohnMcLear]

Responsible disclosure.....

[ghost]

This issue already public on etherpad repository for months :-/ By the way, I tried to contact you about this subject (but not only) two days ago by email.

[JohnMcLear]

Did your email bounce? Did you get a response? I haven't seen anything... ;\ I have been handling other CVE and Security related topics successfully over the previous months with no major problems.

[JohnMcLear]

Just so understand the scope of this bug:

1. Allows user to request downloading all pad contents. Most times it will fail due to, so large instances are safe from privacy concerns but can easily be DoS'd.
2. Has affected all instances since we used UeberDB w/ MySQL [4+ years].
3. Only affects instances running MySQL/PostgreSQL/SQLite [needs confirmation]

Steps to replicate.

1. Bring up Etherpad instance
2. Configure that instance to use MySQL
3. Create two pads, one with a * in the padId (Other special characters IE % and _ should be tested too) For example.. "testHello" and "test*"
4. Attempt to Export (HTML?) the Pad with a * in the padId
5. Etherpad will download all pads.. Profit?

I am going to bring up an instance now to test on.

FAQ:

1. Is DirtyDB effected? No.

[ghost]

Did your email bounce? Did you get a response?

No and no :-/ Tried your personal email and contact@etherpad.org.

[JohnMcLear]

I'm unable to replicate this bug on latest windows release.. See my steps to replicate above.

http://127.0.0.1:9001/p/test%/export/html returns an error, doesn't dump any user data.
http://127.0.0.1:9001/p/test_/export/html behaves as it should (exports test_ document contents)

[ghost]

This issue is worse than this and I can provide you a working proof-of-concept, but not here in public.

[JohnMcLear]

Email me it please :) I'm at my desk right now..