We have a regression of SA-2006-005 - Drupal core - SQL injection vulnerability; db_query_range and friends do not ensure $from and $count are integers.

I doubt it is directly exploitable in core.

CommentFileSizeAuthor
#7 do-811776-prevent-sql-injection.patch2.67 KBheine
#6 do-811776-prevent-sql-injection.patch5.34 KBheine
#4 do-811776-prevent-sql-injection.patch5.34 KBheine
#2 do-811776-prevent-sql-injection.patch5.34 KBheine

Comments

heine’s picture

heine commented
Assigned: Unassigned » heine
heine’s picture

heine commented
Assigned: heine » Unassigned
Status: Active » Needs review
StatusFileSize
new do-811776-prevent-sql-injection.patch5.34 KB

I hope I got them all.

Status: Needs review » Needs work

The last submitted patch, do-811776-prevent-sql-injection.patch, failed testing.

heine’s picture

heine commented
Status: Needs work » Needs review
StatusFileSize
new do-811776-prevent-sql-injection.patch5.34 KB

Reroll

Status: Needs review » Needs work

The last submitted patch, do-811776-prevent-sql-injection.patch, failed testing.

heine’s picture

heine commented
Status: Needs work » Needs review
StatusFileSize
new do-811776-prevent-sql-injection.patch5.34 KB

Last and final attempt. All EOLs have been confirmed to be LF.

heine’s picture

heine commented
StatusFileSize
new do-811776-prevent-sql-injection.patch2.67 KB

And now forced UTF-8 instead of UTF-16LE.

catch’s picture

catch
he/him
Primary language English
commented
Status: Needs review » Reviewed & tested by the community

Looks good.

dries’s picture

dries commented
Status: Reviewed & tested by the community » Fixed

Looks good. Thanks Heine! If only PHP5 supported type hinting for integers ... :)

Crell’s picture

Crell commented

@Dries: There's discussion of that, actually, which has turned into a massive flame war and demonstration of why the PHP development process is fundamentally broken. As of right now, PHP.next is a strictly-typed language rather than weakly-typed like every other PHP version in history. Hopefully that will change soon. :-(

heine’s picture

heine commented
Status: Fixed » Reviewed & tested by the community

@Dries, did you forget to commit it? I see no changes to the db drivers in CVS.

dries’s picture

dries commented
Status: Reviewed & tested by the community » Fixed

Committed. For real now.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.