BUG22529828 Fix potential SQL injection

nmariz · nmariz · commit def354c55908 · 2016-09-22T15:16:37.000+01:00
This patch fixes a potential SQL injection that may occur when
the parameters expansion is done in multiple steps and under
some circumstances a substring in an incoming parameter value
can be expanded several times.
diff --git a/CHANGES.txt b/CHANGES.txt
@@ -13,6 +13,7 @@ v2.1.4
 
 - BUG#22873551: Fix cleartext authentication issue
 - BUG#22545879: Fix usage of --ssl-cipher option
+- BUG#22529828: Fix potencial SQL injection
 - BUG#21881038: Fix duplicate entry in CHANGES.txt
 - BUG#21879914: Fix using SSL without key or certificate using C/Ext
 - BUG#21879859: Fix consuming results after calling procedure
diff --git a/lib/mysql/connector/cursor.py b/lib/mysql/connector/cursor.py
@@ -1,5 +1,5 @@
 # MySQL Connector/Python - MySQL driver written in Python.
-# Copyright (c) 2009, 2015, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2009, 2016, Oracle and/or its affiliates. All rights reserved.
 
 # MySQL Connector/Python is licensed under the terms of the GPLv2
 # <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>, like most
@@ -44,6 +44,14 @@
     re.I | re.M | re.S)
 RE_SQL_INSERT_VALUES = re.compile(r'.*VALUES\s*(\(.*\)).*', re.I | re.M | re.S)
 RE_PY_PARAM = re.compile(b'(%s)')
+RE_PY_MAPPING_PARAM = re.compile(
+    br'''
+    %
+    \((?P<mapping_key>[^)]+)\)
+    (?P<conversion_type>[diouxXeEfFgGcrs%])
+    ''',
+    re.X
+)
 RE_SQL_SPLIT_STMTS = re.compile(
     b''';(?=(?:[^"'`]*["'`][^"'`]*["'`])*[^"'`]*$)''')
 RE_SQL_FIND_PARAM = re.compile(
@@ -75,6 +83,29 @@ def remaining(self):
         return len(self.params) - self.index
 
 
+def _bytestr_format_dict(bytestr, value_dict):
+    """
+    >>> _bytestr_format_dict(b'%(a)s', {b'a': b'foobar'})
+    b'foobar
+    >>> _bytestr_format_dict(b'%%(a)s', {b'a': b'foobar'})
+    b'%%(a)s'
+    >>> _bytestr_format_dict(b'%%%(a)s', {b'a': b'foobar'})
+    b'%%foobar'
+    >>> _bytestr_format_dict(b'%(x)s %(y)s',
+    ...                      {b'x': b'x=%(y)s', b'y': b'y=%(x)s'})
+    b'x=%(y)s y=%(x)s'
+    """
+    def replace(matchobj):
+        groups = matchobj.groupdict()
+        if groups["conversion_type"] == b"%":
+            return b"%"
+        if groups["conversion_type"] == b"s":
+            return value_dict[groups["mapping_key"]]
+        raise ValueError("Unsupported conversion_type: {0}"
+                         "".format(groups["conversion_type"]))
+    return RE_PY_MAPPING_PARAM.sub(replace, bytestr)
+
+
 class CursorBase(MySQLCursorAbstract):
     """
     Base for defining MySQLCursor. This class is a skeleton and defines
@@ -360,9 +391,9 @@ def _process_params_dict(self, params):
                 conv = escape(conv)
                 conv = quote(conv)
                 if PY2:
-                    res["%({0})s".format(key)] = conv
+                    res[key] = conv
                 else:
-                    res["%({0})s".format(key).encode()] = conv
+                    res[key.encode()] = conv
         except Exception as err:
             raise errors.ProgrammingError(
                 "Failed processing pyformat-parameters; %s" % err)
@@ -497,8 +528,8 @@ def execute(self, operation, params=None, multi=False):
 
         if params is not None:
             if isinstance(params, dict):
-                for key, value in self._process_params_dict(params).items():
-                    stmt = stmt.replace(key, value)
+                stmt = _bytestr_format_dict(
+                    stmt, self._process_params_dict(params))
             elif isinstance(params, (list, tuple)):
                 psub = _ParamSubstitutor(self._process_params(params))
                 stmt = RE_PY_PARAM.sub(psub, stmt)
@@ -551,8 +582,8 @@ def remove_comments(match):
             for params in seq_params:
                 tmp = fmt
                 if isinstance(params, dict):
-                    for key, value in self._process_params_dict(params).items():
-                        tmp = tmp.replace(key, value)
+                    tmp = _bytestr_format_dict(
+                        tmp, self._process_params_dict(params))
                 else:
                     psub = _ParamSubstitutor(self._process_params(params))
                     tmp = RE_PY_PARAM.sub(psub, tmp)
diff --git a/tests/test_cursor.py b/tests/test_cursor.py
@@ -1,5 +1,5 @@
 # -*- coding: utf-8 -*-
-# Copyright (c) 2009, 2015, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2009, 2016, Oracle and/or its affiliates. All rights reserved.
 
 # MySQL Connector/Python is licensed under the terms of the GPLv2
 # <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>, like most
@@ -421,28 +421,32 @@ def test__process_params_dict(self):
             'p': datetime.time(20, 3, 23),
             'q': st_now,
             'r': datetime.timedelta(hours=40, minutes=30, seconds=12),
+            's': 'foo %(t)s',
+            't': 'foo %(s)s',
         }
         exp = {
-            b'%(a)s': b'NULL',
-            b'%(b)s': b'128',
-            b'%(c)s': b'1281288',
-            b'%(d)s': repr(float(3.14)) if PY2 else b'3.14',
-            b'%(e)s': b"'3.14'",
-            b'%(f)s': b"'back\\\\slash'",
-            b'%(g)s': b"'newline\\n'",
-            b'%(h)s': b"'return\\r'",
-            b'%(i)s': b"'\\'single\\''",
-            b'%(j)s': b'\'\\"double\\"\'',
-            b'%(k)s': b"'windows\\\x1a'",
-            b'%(l)s': b"'Strings are sexy'",
-            b'%(m)s': b"'\xe8\x8a\xb1'",
-            b'%(n)s': b"'2008-05-07 20:01:23'",
-            b'%(o)s': b"'2008-05-07'",
-            b'%(p)s': b"'20:03:23'",
-            b'%(q)s': b"'" +
+            b'a': b'NULL',
+            b'b': b'128',
+            b'c': b'1281288',
+            b'd': repr(float(3.14)) if PY2 else b'3.14',
+            b'e': b"'3.14'",
+            b'f': b"'back\\\\slash'",
+            b'g': b"'newline\\n'",
+            b'h': b"'return\\r'",
+            b'i': b"'\\'single\\''",
+            b'j': b'\'\\"double\\"\'',
+            b'k': b"'windows\\\x1a'",
+            b'l': b"'Strings are sexy'",
+            b'm': b"'\xe8\x8a\xb1'",
+            b'n': b"'2008-05-07 20:01:23'",
+            b'o': b"'2008-05-07'",
+            b'p': b"'20:03:23'",
+            b'q': b"'" +
             time.strftime('%Y-%m-%d %H:%M:%S', st_now).encode('ascii')
             + b"'",
-            b'%(r)s': b"'40:30:12'",
+            b'r': b"'40:30:12'",
+            b's': b"'foo %(t)s'",
+            b't': b"'foo %(s)s'",
         }
 
         self.cnx = connection.MySQLConnection(**tests.get_mysql_config())
