OSDN Git Service

Execute "strict" queries with extra parentheses.
authorJeff Sharkey <jsharkey@android.com>
Mon, 16 Jul 2018 22:53:45 +0000 (16:53 -0600)
committerJeff Sharkey <jsharkey@android.com>
Mon, 16 Jul 2018 23:21:50 +0000 (17:21 -0600)
commita58d6e3405d8cb63269ec39502589ea6125e1f73
tree2deef64988ab39622ea34a2fd31e6acdc18da149
parent99cc1184232494dd359ddcc6da36b9f672dc39ea
Execute "strict" queries with extra parentheses.

SQLiteQueryBuilder has a setStrict() mode which can be used to
detect SQL attacks from untrusted sources, which it does by running
each query twice: once with an extra set of parentheses, and if that
succeeds, it runs the original query verbatim.

This sadly doesn't catch inputs of the type "1=1) OR (1=1", which
creates valid statements for both tests above, but the final executed
query ends up leaking data due to SQLite operator precedence.

Instead, we need to continue compiling both variants, but we need
to execute the query with the additional parentheses to ensure
data won't be leaked.

Test: atest cts/tests/tests/database/src/android/database/sqlite/cts/SQLiteQueryBuilderTest.java
Bug: 111085900
Change-Id: Ie85a95003ae134eef2fdfbf074c2f82d0a6a9f26
core/java/android/database/sqlite/SQLiteQueryBuilder.java