OSDN Git Service

DO NOT MERGE. Execute "strict" queries with extra parentheses.
authorJeff Sharkey <jsharkey@android.com>
Wed, 25 Jul 2018 20:01:59 +0000 (14:01 -0600)
committerRyan Longair <rlongair@google.com>
Thu, 30 Aug 2018 20:35:48 +0000 (13:35 -0700)
commit83fef270c7c99e81302801b006548c6dbcfe7118
tree9508a16e391916898d06f85bc2c710f0a1b71236
parent1039d219c8b09e2c6be6fd3105d58ebb5b592bd7
DO NOT MERGE. Execute "strict" queries with extra parentheses.

SQLiteQueryBuilder has a setStrict() mode which can be used to
detect SQL attacks from untrusted sources, which it does by running
each query twice: once with an extra set of parentheses, and if that
succeeds, it runs the original query verbatim.

This sadly doesn't catch inputs of the type "1=1) OR (1=1", which
creates valid statements for both tests above, but the final executed
query ends up leaking data due to SQLite operator precedence.

Instead, we need to continue compiling both variants, but we need
to execute the query with the additional parentheses to ensure
data won't be leaked.

Test: atest cts/tests/tests/database/src/android/database/sqlite/cts/SQLiteQueryBuilderTest.java
Bug: 111085900
Change-Id: I6e8746fa48f9de13adae37d2990de11c9c585381
Merged-In: I6e8746fa48f9de13adae37d2990de11c9c585381
(cherry picked from commit 5a55a72fcd18fb676eb4c114e62048068f71c01a)
core/java/android/database/sqlite/SQLiteQueryBuilder.java