Merge r185003 - WebSQL default functions can bypass authorizer.

<rdar://problem/21048994> and https://bugs.webkit.org/show_bug.cgi?id=145463 Reviewed by Sam Weinig and Alexey Proskuryakov. No new tests yet. * platform/sql/SQLiteDatabase.cpp: (WebCore::unauthorizedSQLFunction): Function to install into SQLite to override some built-in functions. (WebCore::SQLiteDatabase::open): (WebCore::SQLiteDatabase::overrideUnauthorizedFunctions): Install function overrides for functions that take arbitrary input that are also meant to be disabled by virtue of them not being whitelisted. * platform/sql/SQLiteDatabase.h:
WebKit · Jul 6, 2015 · fd3a1ca · fd3a1ca
1 parent 6bea461
commit fd3a1ca
Show file tree

Hide file tree

Showing 3 changed files with 44 additions and 1 deletion.
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2015-05-29  Brady Eidson  <beidson@apple.com>
+
+        WebSQL default functions can bypass authorizer.
+        <rdar://problem/21048994> and https://bugs.webkit.org/show_bug.cgi?id=145463
+
+        Reviewed by Sam Weinig and Alexey Proskuryakov.
+
+        No new tests yet.
+
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::unauthorizedSQLFunction): Function to install into SQLite to override some built-in functions.
+        (WebCore::SQLiteDatabase::open):
+        (WebCore::SQLiteDatabase::overrideUnauthorizedFunctions): Install function overrides for functions that
+           take arbitrary input that are also meant to be disabled by virtue of them not being whitelisted.
+        * platform/sql/SQLiteDatabase.h:
+
 2015-05-28  Zalan Bujtas  <zalan@apple.com>
 
         Subpixel rendering: Pixel crack in text selection of simple text in <textarea>.

diff --git a/Source/WebCore/platform/sql/SQLiteDatabase.cpp b/Source/WebCore/platform/sql/SQLiteDatabase.cpp
@@ -50,6 +50,13 @@ WEBCORE_EXPORT const int SQLResultConstraint = SQLITE_CONSTRAINT;
 
 static const char notOpenErrorMessage[] = "database is not open";
 
+static void unauthorizedSQLFunction(sqlite3_context *context, int, sqlite3_value **)
+{
+    const char* functionName = (const char*)sqlite3_user_data(context);
+    String errorMessage = String::format("Function %s is unauthorized", functionName);
+    sqlite3_result_error(context, errorMessage.utf8().data(), -1);
+}
+
 SQLiteDatabase::SQLiteDatabase()
     : m_db(0)
     , m_pageSize(-1)
@@ -82,6 +89,8 @@ bool SQLiteDatabase::open(const String& filename, bool forWebSQLDatabase)
         return false;
     }
 
+    overrideUnauthorizedFunctions();
+
     m_openError = sqlite3_extended_result_codes(m_db, 1);
     if (m_openError != SQLITE_OK) {
         m_openErrorMessage = sqlite3_errmsg(m_db);
@@ -133,6 +142,22 @@ void SQLiteDatabase::close()
     m_openErrorMessage = CString();
 }
 
+void SQLiteDatabase::overrideUnauthorizedFunctions()
+{
+    std::pair<const char*, int> functionParameters[] = {
+        { "rtreenode", 2 },
+        { "rtreedepth", 1 },
+        { "eval", 1 },
+        { "eval", 2 },
+        { "printf", -1 },
+        { "fts3_tokenizer", 1 },
+        { "fts3_tokenizer", 2 },
+    };
+
+    for (auto& functionParameter : functionParameters)
+        sqlite3_create_function(m_db, functionParameter.first, functionParameter.second, SQLITE_UTF8, (void*)functionParameter.first, unauthorizedSQLFunction, 0, 0);
+}
+
 void SQLiteDatabase::interrupt()
 {
     m_interrupted = true;

diff --git a/Source/WebCore/platform/sql/SQLiteDatabase.h b/Source/WebCore/platform/sql/SQLiteDatabase.h
@@ -148,7 +148,9 @@ class SQLiteDatabase {
     void enableAuthorizer(bool enable);
 
     int pageSize();
-
+
+    void overrideUnauthorizedFunctions();
+
     sqlite3* m_db;
     int m_pageSize;