Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not pass in SQL string vars as format strings #723

Merged
merged 2 commits into from
Aug 29, 2019
Merged

Do not pass in SQL string vars as format strings #723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
31ff002
Do not pass in SQL string vars as format strings
timopollmeier Aug 28, 2019
48ed464
Add CHANGELOG for SQL format string fix
timopollmeier Aug 28, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
- Fix response from GET_VULNS when given vuln_id does not exists [#696](https://github.com/greenbone/gvmd/pull/696)
- Make bulk tagging with a filter work if the resources are already tagged [#711](https://github.com/greenbone/gvmd/pull/711)
- Fix columnless search phrase filter keywords with quotes [#715](https://github.com/greenbone/gvmd/pull/715)
- Fix issues importing results or getting them from slaves if they contain "%s" [#723](https://github.com/greenbone/gvmd/pull/723)

### Removed
- The handling of NVT updates via OTP has been removed. [#575](https://github.com/greenbone/gvmd/pull/575)
Expand Down
14 changes: 7 additions & 7 deletions src/manage_sql.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22289,7 +22289,7 @@ create_report (array_t *results, const char *task_id, const char *in_assets,
/* Limit the number of results inserted at a time. */
if (insert_count == CREATE_REPORT_INSERT_SIZE)
{
sql (insert->str);
sql ("%s", insert->str);
g_string_truncate (insert, 0);
count++;
insert_count = 0;
Expand Down Expand Up @@ -22319,7 +22319,7 @@ create_report (array_t *results, const char *task_id, const char *in_assets,

if (first == 0)
{
sql (insert->str);
sql ("%s", insert->str);
report_cache_counts (report, 1, 1, NULL);
sql_commit ();
gvm_usleep (CREATE_REPORT_CHUNK_SLEEP);
Expand Down Expand Up @@ -22414,7 +22414,7 @@ create_report (array_t *results, const char *task_id, const char *in_assets,
/* Limit the number of details inserted at a time. */
if (insert_count == CREATE_REPORT_INSERT_SIZE)
{
sql (insert->str);
sql ("%s", insert->str);
g_string_truncate (insert, 0);
count++;
insert_count = 0;
Expand Down Expand Up @@ -22446,7 +22446,7 @@ create_report (array_t *results, const char *task_id, const char *in_assets,
}

if (first == 0)
sql (insert->str);
sql ("%s", insert->str);

sql_commit ();
g_string_free (insert, TRUE);
Expand Down Expand Up @@ -32562,7 +32562,7 @@ init_task_file_iterator (iterator_t* iterator, task_t task, const char* file)
" FROM task_files"
" WHERE task = %llu;",
task);
init_iterator (iterator, sql);
init_iterator (iterator, "%s", sql);
g_free (sql);
}

Expand Down Expand Up @@ -48701,7 +48701,7 @@ update_from_slave_insert (GString *buffer, report_t report)

g_string_append (buffer, " RETURNING id;");

init_iterator (&ids, buffer->str);
init_iterator (&ids, "%s", buffer->str);
while (next (&ids))
report_add_result_for_buffer (report, iterator_int64 (&ids, 0));
cleanup_iterator (&ids);
Expand All @@ -48716,7 +48716,7 @@ update_from_slave_insert (GString *buffer, report_t report)
report, report);
}
else
sql (buffer->str);
sql ("%s", buffer->str);

g_string_truncate (buffer, 0);
}
Expand Down
6 changes: 3 additions & 3 deletions src/manage_sql_configs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,7 +341,7 @@ init_nvt_selector_iterator (iterator_t* iterator, const char* selector,
" FROM nvt_selectors"
" WHERE type = %i;",
type);
init_iterator (iterator, sql);
init_iterator (iterator, "%s", sql);
g_free (sql);
}

Expand Down Expand Up @@ -3082,7 +3082,7 @@ init_user_config_iterator (iterator_t* iterator, config_t config, int trash,
sort_field ? sort_field : "id",
ascending ? "ASC" : "DESC");
g_free (columns);
init_iterator (iterator, sql);
init_iterator (iterator, "%s", sql);
g_free (sql);
}

Expand Down Expand Up @@ -3360,7 +3360,7 @@ init_preference_iterator (iterator_t* iterator, config_t config)
" FROM config_preferences"
" WHERE config = %llu;",
config);
init_iterator (iterator, sql);
init_iterator (iterator, "%s", sql);
g_free (sql);
}

Expand Down
4 changes: 2 additions & 2 deletions src/manage_sql_nvts.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -703,7 +703,7 @@ init_nvt_iterator (iterator_t* iterator, nvt_t nvt, config_t config,
" FROM nvts WHERE id = %llu;",
nvt_iterator_columns (),
nvt);
init_iterator (iterator, sql);
init_iterator (iterator, "%s", sql);
g_free (sql);
}
else if (config)
Expand All @@ -713,7 +713,7 @@ init_nvt_iterator (iterator_t* iterator, nvt_t nvt, config_t config,
sql = select_config_nvts (config, family, ascending, sort_field);
if (sql)
{
init_iterator (iterator, sql);
init_iterator (iterator, "%s", sql);
g_free (sql);
}
else
Expand Down