Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security mechanism can be defeated by using function name as column name #5

Closed
ianmcook opened this issue Aug 31, 2019 · 1 comment
Closed

Security mechanism can be defeated by using function name as column name #5

ianmcook opened this issue Aug 31, 2019 · 1 comment
Labels
bug Something isn't working

Comments

@ianmcook
Copy link
Owner

The mechanism that stops queryparser from translating an expression if it includes functions that are not on the whitelist can be defeated by including a column name in the expression that has the same name as the disallowed function. For example:

parse_expression("system + system('ls')")
#system + system("ls")

This is caused by the way the all_funs function is implemented.
ianmcook pushed a commit that referenced this issue Aug 31, 2019
Fix vulnerability in security mechanism (#5)
173cf64
@ianmcook
Copy link
Owner Author

Fixed in 173cf64

@ianmcook ianmcook added the bug Something isn't working label Aug 31, 2019
ianmcook pushed a commit that referenced this issue Aug 31, 2019
Test fix for security vulnerability (#5)
39d4b7e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@ianmcook