Skip to content

/ queryparser

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security mechanism can be defeated by using function name as column name #5

Closed
ianmcook opened this issue Aug 31, 2019 · 1 comment
Closed

Security mechanism can be defeated by using function name as column name #5

ianmcook opened this issue Aug 31, 2019 · 1 comment
Labels
bug

Comments

@ianmcook
Copy link
Owner

@ianmcook ianmcook commented Aug 31, 2019

The mechanism that stops queryparser from translating an expression if it includes functions that are not on the whitelist can be defeated by including a column name in the expression that has the same name as the disallowed function. For example:

parse_expression("system + system('ls')")
#system + system("ls")

This is caused by the way the all_funs function is implemented.
ianmcook added a commit that referenced this issue Aug 31, 2019
@ianmcook
Fix vulnerability in security mechanism (#5)
173cf64
@ianmcook
Copy link
Owner Author

@ianmcook ianmcook commented Aug 31, 2019

Fixed in 173cf64
@ianmcook ianmcook closed this Aug 31, 2019
@ianmcook ianmcook added the bug label Aug 31, 2019
ianmcook added a commit that referenced this issue Aug 31, 2019
@ianmcook
Test fix for security vulnerability (#5)
39d4b7e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
1 participant
@ianmcook
You can’t perform that action at this time.