Skip to content

Commit f90fe0f

Browse files
yamaceayyamaceay
committed
prevent sql injection
1 parent a89446e commit f90fe0f

19 files changed

Lines changed: 214 additions & 220 deletions

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ test-e2e: $(KIND) $(HELM3) build
5757
@$(INFO) running e2e tests
5858
@echo E2E_IMAGES=$$E2E_IMAGES
5959
# echo E2E_IMAGES=$$E2E_IMAGES > e2e.env
60-
HANA_BINDINGS=$$HANA_BINDINGS go test $(PROJECT_REPO)/test/... -tags=e2e -test.v -count=1
60+
source test/e2e/secrets/secrets.env && HANA_BINDINGS=$$HANA_BINDINGS go test $(PROJECT_REPO)/test/... -tags=e2e -test.v -count=1
6161
@$(OK) e2e tests passed
6262

6363
# Update the submodules, such as the common build scripts.

‎apis/admin/v1alpha1/auditpolicy_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,16 @@ import (
1717
type AuditPolicyParameters struct {
1818
PolicyName string `json:"policyName"`
1919

20+
// +kubebuilder:validation:items:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60]+$`
21+
// +listType=set
2022
AuditActions []string `json:"auditActions"`
2123

2224
// +kubebuilder:default:=ALL
25+
// +kubebuilder:validation:Enum:=SUCCESSFUL;UNSUCCESSFUL;ALL
2326
AuditStatus string `json:"auditStatus,omitempty"`
2427

2528
// +kubebuilder:default:=CRITICAL
29+
// +kubebuilder:validation:Enum:=EMERGENCY;ALERT;CRITICAL;WARNING;INFO
2630
AuditLevel string `json:"auditLevel,omitempty"`
2731

2832
// +kubebuilder:default:=7

‎apis/admin/v1alpha1/role_types.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,16 @@ import (
1717
type RoleParameters struct {
1818
// +kubebuilder:validation:Optional
1919
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
20-
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60a-z]+$`
2120
RoleName string `json:"roleName"`
2221

2322
// +kubebuilder:validation:Optional
2423
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
25-
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60a-z]+$`
2624
Schema string `json:"schema,omitempty"`
2725

26+
// +listType=set
2827
LdapGroups []string `json:"ldapGroups,omitempty"`
2928

29+
// +listType=set
3030
Privileges []string `json:"privileges,omitempty"`
3131

3232
// +kubebuilder:validation:Optional

‎apis/admin/v1alpha1/user_types.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ type Password struct {
2929
type UserParameters struct {
3030
// +kubebuilder:validation:Optional
3131
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
32-
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60a-z]+$`
32+
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60]+$`
3333
Username string `json:"username"`
3434

3535
// +kubebuilder:validation:Optional
@@ -49,7 +49,7 @@ type UserParameters struct {
4949
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
5050
Parameters map[string]string `json:"parameters,omitempty"`
5151

52-
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60a-z]+$`
52+
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60]+$`
5353
// +kubebuilder:default:=DEFAULT
5454
Usergroup string `json:"usergroup,omitempty" default:"DEFAULT"`
5555

‎apis/admin/v1alpha1/usergroup_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ import (
1616
type UsergroupParameters struct {
1717
// +kubebuilder:validation:Optional
1818
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
19-
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60a-z]+$`
2019
UsergroupName string `json:"usergroupName"`
2120

2221
DisableUserAdmin bool `json:"disableUserAdmin,omitempty"`
@@ -29,6 +28,7 @@ type UsergroupParameters struct {
2928

3029
// +kubebuilder:validation:Optional
3130
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
31+
// +kubebuilder:validation:Enum:="";password policy
3232
EnableParameterSet string `json:"enableParameterSet,omitempty"`
3333
}
3434

‎apis/schema/v1alpha1/dbschema_types.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,9 @@ import (
1717
type DbSchemaParameters struct {
1818
// +kubebuilder:validation:Optional
1919
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
20-
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60a-z]+$`
2120
SchemaName string `json:"schemaName"`
2221

23-
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60a-z]+$`
22+
// +kubebuilder:validation:Pattern:=`^[^",\$\.'\+\-<>|\[\]\{\}\(\)!%*,/:;=\?@\\^~\x60]+$`
2423
Owner string `json:"owner,omitempty"`
2524
}
2625

‎internal/clients/hana/dbschema/dbschema_client.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"github.com/SAP/crossplane-provider-hana/apis/schema/v1alpha1"
88
"github.com/SAP/crossplane-provider-hana/internal/clients/hana"
99
"github.com/SAP/crossplane-provider-hana/internal/clients/xsql"
10+
"github.com/SAP/crossplane-provider-hana/internal/utils"
1011
)
1112

1213
// DbSchemaClient defines the interface for dbschema client operations
@@ -43,7 +44,7 @@ func (c Client) Read(ctx context.Context, parameters *v1alpha1.DbSchemaParameter
4344
// Create a new schema
4445
func (c Client) Create(ctx context.Context, parameters *v1alpha1.DbSchemaParameters) error {
4546

46-
query := fmt.Sprintf("CREATE SCHEMA %s", parameters.SchemaName)
47+
query := fmt.Sprintf(`CREATE SCHEMA "%s"`, utils.EscapeDoubleQuotes(parameters.SchemaName))
4748

4849
if parameters.Owner != "" {
4950
query += fmt.Sprintf(" OWNED BY %s", parameters.Owner)
@@ -57,7 +58,7 @@ func (c Client) Create(ctx context.Context, parameters *v1alpha1.DbSchemaParamet
5758
// Delete an existing schema
5859
func (c Client) Delete(ctx context.Context, parameters *v1alpha1.DbSchemaParameters) error {
5960

60-
query := fmt.Sprintf("DROP SCHEMA %s", parameters.SchemaName)
61+
query := fmt.Sprintf(`DROP SCHEMA "%s"`, utils.EscapeDoubleQuotes(parameters.SchemaName))
6162

6263
_, err := c.ExecContext(ctx, query)
6364

‎internal/clients/hana/role/role_client.go‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"github.com/SAP/crossplane-provider-hana/internal/clients/hana"
1111
"github.com/SAP/crossplane-provider-hana/internal/clients/hana/privilege"
1212
"github.com/SAP/crossplane-provider-hana/internal/clients/xsql"
13+
"github.com/SAP/crossplane-provider-hana/internal/utils"
1314
)
1415

1516
// RoleClient defines the interface for role client operations
@@ -92,12 +93,12 @@ func observeLdapGroups(ctx context.Context, db xsql.DB, roleName string) (ldapGr
9293
// Create creates a new role in the db
9394
func (c Client) Create(ctx context.Context, parameters *v1alpha1.RoleParameters) error {
9495

95-
query := fmt.Sprintf("CREATE ROLE %s", getRoleName(parameters.Schema, parameters.RoleName))
96+
query := fmt.Sprintf(`CREATE ROLE %s`, getRoleName(parameters.Schema, parameters.RoleName))
9697

9798
if len(parameters.LdapGroups) > 0 {
9899
query += " LDAP GROUP"
99100
for _, ldapGroup := range parameters.LdapGroups {
100-
query += fmt.Sprintf(" '%s',", ldapGroup)
101+
query += fmt.Sprintf(" '%s',", utils.EscapeSingleQuotes(ldapGroup))
101102
}
102103
query = strings.TrimSuffix(query, ",")
103104
}
@@ -124,24 +125,24 @@ func (c Client) Create(ctx context.Context, parameters *v1alpha1.RoleParameters)
124125
func (c Client) UpdateLdapGroups(ctx context.Context, parameters *v1alpha1.RoleParameters, groupsToAdd, groupsToRemove []string) error {
125126

126127
if len(groupsToAdd) > 0 {
127-
query := fmt.Sprintf("ALTER ROLE %s ADD LDAP GROUP", getRoleName(parameters.Schema, parameters.RoleName))
128+
query := fmt.Sprintf(`ALTER ROLE %s ADD LDAP GROUP`, getRoleName(parameters.Schema, parameters.RoleName))
128129
for _, ldapGroup := range groupsToAdd {
129-
query += fmt.Sprintf(" '%s',", ldapGroup)
130+
query += fmt.Sprintf(" '%s',", utils.EscapeSingleQuotes(ldapGroup))
130131
}
131132
query = strings.TrimSuffix(query, ",")
132133
if _, err := c.ExecContext(ctx, query); err != nil {
133-
return fmt.Errorf("failed to add ldap groups: %w", err)
134+
return err
134135
}
135136
}
136137

137138
if len(groupsToRemove) > 0 {
138139
query := fmt.Sprintf("ALTER ROLE %s DROP LDAP GROUP", getRoleName(parameters.Schema, parameters.RoleName))
139140
for _, ldapGroup := range groupsToRemove {
140-
query += fmt.Sprintf(" '%s',", ldapGroup)
141+
query += fmt.Sprintf(" '%s',", utils.EscapeSingleQuotes(ldapGroup))
141142
}
142143
query = strings.TrimSuffix(query, ",")
143144
if _, err := c.ExecContext(ctx, query); err != nil {
144-
return fmt.Errorf("failed to remove ldap groups: %w", err)
145+
return err
145146
}
146147
}
147148

@@ -185,8 +186,10 @@ func (c Client) Delete(ctx context.Context, parameters *v1alpha1.RoleParameters)
185186
}
186187

187188
func getRoleName(schemaName, roleName string) string {
189+
roleNameEscaped := fmt.Sprintf(`"%s"`, utils.EscapeDoubleQuotes(roleName))
188190
if schemaName != "" {
189-
return fmt.Sprintf("%s.%s", schemaName, roleName)
191+
schemaNameEscaped := fmt.Sprintf(`"%s"`, utils.EscapeDoubleQuotes(schemaName))
192+
return fmt.Sprintf("%s.%s", schemaNameEscaped, roleNameEscaped)
190193
}
191-
return roleName
194+
return roleNameEscaped
192195
}

‎internal/clients/hana/user/user_client.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/SAP/crossplane-provider-hana/apis/admin/v1alpha1"
1616
"github.com/SAP/crossplane-provider-hana/internal/clients/hana/privilege"
1717
"github.com/SAP/crossplane-provider-hana/internal/clients/xsql"
18+
"github.com/SAP/crossplane-provider-hana/internal/utils"
1819
)
1920

2021
// Error types for user authentication issues
@@ -296,9 +297,9 @@ func (c Client) Create(ctx context.Context, parameters *v1alpha1.UserParameters,
296297
func setParameters(query string, parameters map[string]string) string {
297298
newParams := make([]string, 0, len(parameters))
298299
for key, value := range parameters {
299-
key = strings.ToUpper(key)
300-
if slices.Contains(validParams, key) {
301-
newParams = append(newParams, fmt.Sprintf("%s = '%s'", key, value))
300+
upperKey := strings.ToUpper(key)
301+
if slices.Contains(validParams, upperKey) {
302+
newParams = append(newParams, fmt.Sprintf("%s = '%s'", upperKey, utils.EscapeSingleQuotes(value)))
302303
}
303304
}
304305
if len(newParams) == 0 {

‎internal/clients/hana/usergroup/usergroup_client.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"github.com/SAP/crossplane-provider-hana/apis/admin/v1alpha1"
99
"github.com/SAP/crossplane-provider-hana/internal/clients/hana"
1010
"github.com/SAP/crossplane-provider-hana/internal/clients/xsql"
11+
"github.com/SAP/crossplane-provider-hana/internal/utils"
1112
)
1213

1314
// UsergroupClient defines the interface for usergroup client operations
@@ -70,7 +71,7 @@ func (c Client) Read(ctx context.Context, parameters *v1alpha1.UsergroupParamete
7071
// Create creates a usergroup
7172
func (c Client) Create(ctx context.Context, parameters *v1alpha1.UsergroupParameters) error {
7273

73-
query := fmt.Sprintf("CREATE USERGROUP %s", parameters.UsergroupName)
74+
query := fmt.Sprintf(`CREATE USERGROUP "%s"`, utils.EscapeDoubleQuotes(parameters.UsergroupName))
7475

7576
if parameters.DisableUserAdmin {
7677
query += " DISABLE USER ADMIN"
@@ -83,7 +84,7 @@ func (c Client) Create(ctx context.Context, parameters *v1alpha1.UsergroupParame
8384
if len(parameters.Parameters) > 0 {
8485
query += " SET PARAMETER"
8586
for key, value := range parameters.Parameters {
86-
query += fmt.Sprintf(" '%s' = '%s',", key, value)
87+
query += fmt.Sprintf(" '%s' = '%s',", utils.EscapeSingleQuotes(key), utils.EscapeSingleQuotes(value))
8788
}
8889
query = strings.TrimSuffix(query, ",")
8990
}
@@ -102,7 +103,7 @@ func (c Client) Create(ctx context.Context, parameters *v1alpha1.UsergroupParame
102103
// UpdateDisableUserAdmin updates the disableUserAdmin property of the usergroup
103104
func (c Client) UpdateDisableUserAdmin(ctx context.Context, parameters *v1alpha1.UsergroupParameters) error {
104105

105-
query := fmt.Sprintf("ALTER USERGROUP %s", parameters.UsergroupName)
106+
query := fmt.Sprintf(`ALTER USERGROUP "%s"`, utils.EscapeDoubleQuotes(parameters.UsergroupName))
106107

107108
if parameters.DisableUserAdmin {
108109
query += " DISABLE USER ADMIN"
@@ -120,7 +121,7 @@ func (c Client) UpdateDisableUserAdmin(ctx context.Context, parameters *v1alpha1
120121
// UpdateParameters updates the parameters of the usergroup
121122
func (c Client) UpdateParameters(ctx context.Context, parameters *v1alpha1.UsergroupParameters, changedParameters map[string]string) error {
122123

123-
query := fmt.Sprintf("ALTER USERGROUP %s", parameters.UsergroupName)
124+
query := fmt.Sprintf(`ALTER USERGROUP "%s"`, utils.EscapeDoubleQuotes(parameters.UsergroupName))
124125
query += " SET PARAMETER"
125126
for key, value := range changedParameters {
126127
query += fmt.Sprintf(" '%s' = '%s',", key, value)
@@ -136,7 +137,7 @@ func (c Client) UpdateParameters(ctx context.Context, parameters *v1alpha1.Userg
136137
// Delete deletes the usergroup
137138
func (c Client) Delete(ctx context.Context, parameters *v1alpha1.UsergroupParameters) error {
138139

139-
query := fmt.Sprintf("DROP USERGROUP %s", parameters.UsergroupName)
140+
query := fmt.Sprintf(`DROP USERGROUP "%s"`, utils.EscapeDoubleQuotes(parameters.UsergroupName))
140141

141142
if _, err := c.ExecContext(ctx, query); err != nil {
142143
return err

0 commit comments

Comments
 (0)