kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2026-07-23 16:05:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection

Browse Source 
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.

For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.

For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.

Resolves: #GHSA-ph27-3m5q-mj5m
This commit is contained in:
Milan Kyselica
2026-03-23 15:18:48 +01:00
committed by George Joseph
parent a846b9a012
commit 97f0aac7df
2 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cel/cel_pgsql.c
+15 -2
View File
@@ -224,12 +224,25 @@ static void pgsql_log(struct ast_event *event)
} else {
/* Char field, probably */
const char *event_name;
size_t required_size;
event_name = (!cel_show_user_def
&& record.event_type == AST_CEL_USER_DEFINED)
? record.user_defined_name : record.event_name;
LENGTHEN_BUF2(strlen(event_name) + 1);
ast_str_append(&sql2, 0, "%s'%s'", SEP, event_name);
required_size = strlen(event_name) * 2 + 1;
if (required_size > bufsize) {
char *tmpbuf = ast_realloc(escapebuf, required_size);
if (!tmpbuf) {
AST_RWLIST_UNLOCK(&psql_columns);
goto ast_log_cleanup;
}
escapebuf = tmpbuf;
bufsize = required_size;
}
PQescapeStringConn(conn, escapebuf, event_name,
strlen(event_name), NULL);
LENGTHEN_BUF2(strlen(escapebuf) + 3);
ast_str_append(&sql2, 0, "%s'%s'", SEP, escapebuf);
}
} else if (strcmp(cur->name, "amaflags") == 0) {
if (strncmp(cur->type, "int", 3) == 0) {