Skip to content
This repository has been archived by the owner on Jul 10, 2024. It is now read-only.

SUBMARINE-1361. Fix Submarine SQL injection vulnerability #1037

Closed
wants to merge 1 commit into from
Closed

SUBMARINE-1361. Fix Submarine SQL injection vulnerability #1037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ...erver-database/src/main/resources/org/apache/submarine/database/mappers/SysDeptMapper.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,8 @@
SELECT a.*, b.dept_name AS parent_name
FROM sys_department a LEFT JOIN sys_department b ON a.parent_code=b.dept_code
WHERE 1=1
<if test="deptCode!=null and deptCode!=''"> AND a.`dept_code` like '%${deptCode}%' </if>
<if test="deptName!=null and deptName!=''"> AND a.`dept_name` like '%${deptName}%' </if>
<if test="deptCode!=null and deptCode!=''"> AND a.`dept_code` like concat('%', #{deptCode}, '%')</if>
<if test="deptName!=null and deptName!=''"> AND a.`dept_name` like concat('%', #{deptName}, '%')</if>
ORDER BY a.sort_order
</select>

Expand Down
4 changes: 2 additions & 2 deletions ...r-database/src/main/resources/org/apache/submarine/database/mappers/SysDictItemMapper.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,8 @@
<select id="selectAll" resultMap="resultMap">
SELECT * FROM sys_dict_item WHERE 1 = 1
<if test="dictCode!=null and dictCode!=''"> AND `dict_code` = #{dictCode}</if>
<if test="itemCode!=null and itemCode!=''"> AND `item_code` like '%${itemCode}%'</if>
<if test="itemName!=null and itemName!=''"> AND `item_name` like '%${itemName}%'</if>
<if test="itemCode!=null and itemCode!=''"> AND `item_code` like concat('%', #{itemCode}, '%')</if>
<if test="itemName!=null and itemName!=''"> AND `item_name` like concat('%', #{itemName}, '%')</if>
ORDER BY sort_order
</select>
<resultMap id="resultMap" type="org.apache.submarine.server.database.workbench.entity.SysDictItemEntity" extends="BaseEntityResultMap">
Expand Down
4 changes: 2 additions & 2 deletions ...erver-database/src/main/resources/org/apache/submarine/database/mappers/SysDictMapper.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,8 @@
<select id="selectAll" parameterType="java.util.Map" resultMap="resultMap">
SELECT * FROM sys_dict
WHERE 1=1
<if test="dictCode!=null and dictCode!=''">AND `dict_code` like '%${dictCode}%'</if>
<if test="dictName!=null and dictName!=''">AND `dict_name` like '%${dictName}%'</if>
<if test="dictCode!=null and dictCode!=''">AND `dict_code` like concat('%', #{dictCode}, '%')</if>
<if test="dictName!=null and dictName!=''">AND `dict_name` like concat('%', #{dictName}, '%')</if>
ORDER BY id
</select>
<resultMap id="resultMap" type="org.apache.submarine.server.database.workbench.entity.SysDictEntity" extends="BaseEntityResultMap">
Expand Down
4 changes: 2 additions & 2 deletions ...erver-database/src/main/resources/org/apache/submarine/database/mappers/SysUserMapper.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,8 +39,8 @@
SELECT a.*, b.dept_name FROM sys_user a LEFT JOIN sys_department b ON a.dept_code = b.dept_code
WHERE 1 = 1
<if test="deptCode!=null and deptCode!=''"> AND a.`dept_code` = #{deptCode}</if>
<if test="userName!=null and userName!=''"> AND a.`user_name` like '%${userName}%'</if>
<if test="email!=null and email!=''"> AND a.`email` like '%${email}%'</if>
<if test="userName!=null and userName!=''"> AND a.`user_name` like concat('%', #{userName}, '%')</if>
<if test="email!=null and email!=''"> AND a.`email` like concat('%', #{email}, '%')</if>
ORDER BY a.create_time
</select>

Expand Down
13 changes: 13 additions & 0 deletions ...a/org/apache/submarine/server/database/workbench/database/service/SysUserServiceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,19 @@ public void addUserTest() throws Exception {
10);
LOG.debug("userList.size():{}", userList.size());
assertEquals(userList.size(), 1);

// Avoid sql injection.
// Issue: https://issues.apache.org/jira/browse/SUBMARINE-1361
List<SysUserEntity> sqlInjectTestList = userService.queryPageList(
String.format("%s' or 1=1 or 1='", sysUser.getUserName()),
null,
null,
null,
null,
0,
10);
assertEquals("SQL Injection Vulnerability Detected!", sqlInjectTestList.size(), 0);

SysUserEntity user = userList.get(0);

assertEquals(sysUser.getEmail(), user.getEmail());
Expand Down