Skip to content

Commit 73922e7

Browse files
SebastianStehleSebastianStehle
committed
Security fixes.
1 parent 10f0bf6 commit 73922e7

22 files changed

Lines changed: 155 additions & 280 deletions

File tree

‎backend/src/Squidex.Data.EntityFramework/Providers/MySql/Extensions.cs‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ internal static class Extensions
1616
public static StringBuilder AppendJsonPath(this StringBuilder sb, PropertyPath path)
1717
{
1818
sb.Append('`');
19-
sb.Append(path[0]);
19+
// Escape embedded backticks so a crafted path segment cannot break out of the identifier.
20+
sb.Append(path[0].Replace("`", "``", StringComparison.Ordinal));
2021
sb.Append("`, ");
2122
sb.AppendJsonPropertyPath(path);
2223
return sb;
@@ -36,7 +37,7 @@ public static StringBuilder AppendJsonPropertyPath(this StringBuilder sb, Proper
3637
{
3738
sb.Append('.');
3839
sb.Append('"');
39-
sb.Append(property);
40+
sb.Append(EscapeProperty(property));
4041
sb.Append('"');
4142
}
4243
}
@@ -45,6 +46,22 @@ public static StringBuilder AppendJsonPropertyPath(this StringBuilder sb, Proper
4546
return sb;
4647
}
4748

49+
// The property name is a user-controlled JSON path segment that is embedded as a double-quoted
50+
// member inside a single-quoted SQL string literal. Escape double-quotes/backslashes at the
51+
// JSON-path level, then backslashes/single-quotes at the MySQL string-literal level. MySQL treats
52+
// the backslash as a string-literal escape character, so the JSON-path escapes must themselves be
53+
// escaped again to survive string-literal parsing. This prevents SQL injection.
54+
private static string EscapeProperty(string property)
55+
{
56+
return property
57+
// JSON path escaping.
58+
.Replace("\\", "\\\\", StringComparison.Ordinal)
59+
.Replace("\"", "\\\"", StringComparison.Ordinal)
60+
// MySQL string-literal escaping.
61+
.Replace("\\", "\\\\", StringComparison.Ordinal)
62+
.Replace("'", "''", StringComparison.Ordinal);
63+
}
64+
4865
public static string JsonSubPath(this PropertyPath path)
4966
{
5067
return new StringBuilder().AppendJsonPropertyPath(path).ToString();

‎backend/src/Squidex.Data.EntityFramework/Providers/Postgres/App/Extensions.cs‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ public static class Extensions
1616
public static StringBuilder AppendJsonPath(this StringBuilder sb, PropertyPath path, bool asString)
1717
{
1818
sb.Append('"');
19-
sb.Append(path[0]);
19+
// Escape embedded quotes so a crafted path segment cannot break out of the quoted identifier.
20+
sb.Append(path[0].Replace("\"", "\"\"", StringComparison.Ordinal));
2021
sb.Append('"');
2122

2223
var i = 1;
@@ -37,7 +38,11 @@ public static StringBuilder AppendJsonPath(this StringBuilder sb, PropertyPath p
3738
}
3839
else
3940
{
40-
sb.Append($"'{property}'");
41+
// The property name is a user-controlled JSON path segment that is embedded as a
42+
// single-quoted string literal. Escape embedded quotes to prevent SQL injection.
43+
sb.Append('\'');
44+
sb.Append(property.Replace("'", "''", StringComparison.Ordinal));
45+
sb.Append('\'');
4146
}
4247

4348
i++;

‎backend/src/Squidex.Data.EntityFramework/Providers/SqlServer/Extensions.cs‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ internal static class Extensions
1616
public static StringBuilder AppendJsonPath(this StringBuilder sb, PropertyPath path)
1717
{
1818
sb.Append('[');
19-
sb.Append(path[0]);
19+
// Escape embedded closing brackets so a crafted path segment cannot break out of the identifier.
20+
sb.Append(path[0].Replace("]", "]]", StringComparison.Ordinal));
2021
sb.Append("], ");
2122
sb.AppendJsonSubPath(path);
2223
return sb;
@@ -36,7 +37,7 @@ public static StringBuilder AppendJsonSubPath(this StringBuilder sb, PropertyPat
3637
{
3738
sb.Append('.');
3839
sb.Append('"');
39-
sb.Append(property);
40+
sb.Append(EscapeProperty(property));
4041
sb.Append('"');
4142
}
4243
}
@@ -45,6 +46,19 @@ public static StringBuilder AppendJsonSubPath(this StringBuilder sb, PropertyPat
4546
return sb;
4647
}
4748

49+
// The property name is a user-controlled JSON path segment that is embedded as a double-quoted
50+
// member inside a single-quoted SQL string literal. Escape backslashes and double-quotes at the
51+
// JSON-path level and single-quotes at the SQL-literal level to prevent SQL injection. SQL Server
52+
// does not treat the backslash as a string-literal escape character, so the JSON-path escapes
53+
// reach the JSON parser verbatim.
54+
private static string EscapeProperty(string property)
55+
{
56+
return property
57+
.Replace("\\", "\\\\", StringComparison.Ordinal)
58+
.Replace("\"", "\\\"", StringComparison.Ordinal)
59+
.Replace("'", "''", StringComparison.Ordinal);
60+
}
61+
4862
public static string JsonSubPath(this PropertyPath path)
4963
{
5064
return new StringBuilder().AppendJsonSubPath(path).ToString();

‎backend/src/Squidex.Data.EntityFramework/Squidex.Data.EntityFramework.csproj‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,13 @@
4343
<PackageReference Include="Microting.EntityFrameworkCore.MySql.Json.Microsoft" Version="10.0.6" />
4444
<PackageReference Include="Microting.EntityFrameworkCore.MySql.NetTopologySuite" Version="10.0.6" />
4545
<PackageReference Include="RefactoringEssentials" Version="5.6.0" PrivateAssets="all" />
46-
<PackageReference Include="Squidex.AI.EntityFramework" Version="8.0.1" />
47-
<PackageReference Include="Squidex.Assets.EntityFramework" Version="8.0.1" />
48-
<PackageReference Include="Squidex.Assets.TusAdapter" Version="8.0.1" />
49-
<PackageReference Include="Squidex.Events.EntityFramework" Version="8.0.1" />
50-
<PackageReference Include="Squidex.Flows.EntityFramework" Version="8.0.1" />
51-
<PackageReference Include="Squidex.Hosting" Version="8.0.1" />
52-
<PackageReference Include="Squidex.Messaging.EntityFramework" Version="8.0.1" />
46+
<PackageReference Include="Squidex.AI.EntityFramework" Version="8.0.3" />
47+
<PackageReference Include="Squidex.Assets.EntityFramework" Version="8.0.3" />
48+
<PackageReference Include="Squidex.Assets.TusAdapter" Version="8.0.3" />
49+
<PackageReference Include="Squidex.Events.EntityFramework" Version="8.0.3" />
50+
<PackageReference Include="Squidex.Flows.EntityFramework" Version="8.0.3" />
51+
<PackageReference Include="Squidex.Hosting" Version="8.0.3" />
52+
<PackageReference Include="Squidex.Messaging.EntityFramework" Version="8.0.3" />
5353
<PackageReference Include="Squidex.OpenIdDict.EntityFramework" Version="7.2.1" />
5454
<PackageReference Include="StyleCop.Analyzers" Version="1.1.118" PrivateAssets="all" />
5555
<PackageReference Include="System.ValueTuple" Version="4.6.2" />

‎backend/src/Squidex.Data.MongoDb/Squidex.Data.MongoDb.csproj‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,17 @@
2020
<PrivateAssets>all</PrivateAssets>
2121
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
2222
</PackageReference>
23-
<PackageReference Include="MongoDB.Driver" Version="3.8.0" />
24-
<PackageReference Include="MongoDB.Driver.Authentication.AWS" Version="3.8.0" />
23+
<PackageReference Include="MongoDB.Driver" Version="3.10.0" />
24+
<PackageReference Include="MongoDB.Driver.Authentication.AWS" Version="3.10.0" />
2525
<PackageReference Include="MongoDB.Driver.Core.Extensions.DiagnosticSources" Version="3.0.0" />
2626
<PackageReference Include="NodaTime.Serialization.SystemTextJson" Version="1.3.1" />
2727
<PackageReference Include="RefactoringEssentials" Version="5.6.0" PrivateAssets="all" />
28-
<PackageReference Include="Squidex.AI.Mongo" Version="8.0.1" />
29-
<PackageReference Include="Squidex.Assets.Mongo" Version="8.0.1" />
30-
<PackageReference Include="Squidex.Events.Mongo" Version="8.0.1" />
31-
<PackageReference Include="Squidex.Flows.Mongo" Version="8.0.1" />
32-
<PackageReference Include="Squidex.Hosting" Version="8.0.1" />
33-
<PackageReference Include="Squidex.Messaging.Mongo" Version="8.0.1" />
28+
<PackageReference Include="Squidex.AI.Mongo" Version="8.0.3" />
29+
<PackageReference Include="Squidex.Assets.Mongo" Version="8.0.3" />
30+
<PackageReference Include="Squidex.Events.Mongo" Version="8.0.3" />
31+
<PackageReference Include="Squidex.Flows.Mongo" Version="8.0.3" />
32+
<PackageReference Include="Squidex.Hosting" Version="8.0.3" />
33+
<PackageReference Include="Squidex.Messaging.Mongo" Version="8.0.3" />
3434
<PackageReference Include="Squidex.OpenIddict.MongoDb" Version="7.2.1" />
3535
<PackageReference Include="StyleCop.Analyzers" Version="1.1.118" PrivateAssets="all" />
3636
<PackageReference Include="System.ValueTuple" Version="4.6.2" />

‎backend/src/Squidex.Domain.Apps.Core.Model/Squidex.Domain.Apps.Core.Model.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
<PackageReference Include="NetTopologySuite" Version="2.6.0" />
2121
<PackageReference Include="NodaTime.Serialization.SystemTextJson" Version="1.3.1" />
2222
<PackageReference Include="RefactoringEssentials" Version="5.6.0" PrivateAssets="all" />
23-
<PackageReference Include="Squidex.Flows" Version="8.0.1" />
23+
<PackageReference Include="Squidex.Flows" Version="8.0.3" />
2424
<PackageReference Include="StyleCop.Analyzers" Version="1.1.118" PrivateAssets="all" />
2525
<PackageReference Include="System.ComponentModel.Annotations" Version="5.0.0" />
2626
</ItemGroup>

‎backend/src/Squidex.Domain.Apps.Core.Operations/Squidex.Domain.Apps.Core.Operations.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@
2929
<PackageReference Include="NJsonSchema" Version="11.6.1" />
3030
<PackageReference Include="NodaTime.Serialization.SystemTextJson" Version="1.3.1" />
3131
<PackageReference Include="RefactoringEssentials" Version="5.6.0" PrivateAssets="all" />
32-
<PackageReference Include="Squidex.AI" Version="8.0.1" />
33-
<PackageReference Include="Squidex.Messaging.Subscriptions" Version="8.0.1" />
32+
<PackageReference Include="Squidex.AI" Version="8.0.3" />
33+
<PackageReference Include="Squidex.Messaging.Subscriptions" Version="8.0.3" />
3434
<PackageReference Include="StyleCop.Analyzers" Version="1.1.118" PrivateAssets="all" />
3535
<PackageReference Include="System.Linq.Async" Version="7.0.1" />
3636
<PackageReference Include="ValueTaskSupplement" Version="1.1.0" />

‎backend/src/Squidex.Infrastructure/Http/SsrfExtensions.cs‎

Lines changed: 0 additions & 72 deletions
This file was deleted.

‎backend/src/Squidex.Infrastructure/Http/SsrfHelper.cs‎

Lines changed: 0 additions & 66 deletions
This file was deleted.

‎backend/src/Squidex.Infrastructure/Http/SsrfOptions.cs‎

Lines changed: 0 additions & 37 deletions
This file was deleted.

0 commit comments

Comments
 (0)