mirrors/nextcloud-android
1
0
Fork 0
mirror of https://github.com/nextcloud/android.git synced 2024-11-25 22:55:46 +03:00
Code Issues Projects Releases Packages Wiki Activity

FileContentProvider: Use SQLiteTokenizer for sortOrder verification too

Browse source 
More reliable than just splitting by spaces.

Signed-off-by: Álvaro Brey Vilas <alvaro.brey@nextcloud.com>
This commit is contained in:
Álvaro Brey Vilas 2021-12-21 15:06:05 +01:00
parent b3aeab9004
commit 724b75d5d3
No known key found for this signature in database
GPG key ID: 2585783189A62105
1 changed files with 22 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
src/main/java/com/owncloud/android/providers/FileContentProvider.java
View file

@ -1093,30 +1093,39 @@ public class FileContentProvider extends ContentProvider {
} }
public static void verifySortOrder(@Nullable String sortOrder) { public static void verifySortOrder(@Nullable String sortOrder) {
if (TextUtils.isEmpty(sortOrder)) { if (sortOrder == null) {
return; return;
} }
for (String segment : sortOrder.split(" +")) { SQLiteTokenizer.tokenize(sortOrder, SQLiteTokenizer.OPTION_NONE, VerificationUtils::verifySortToken);
switch (segment.toLowerCase(Locale.ROOT)) { }
case "asc":
case "desc": private static void verifySortToken(String token){
case "collate": // accept empty tokens and valid column names
case "nocase": if (TextUtils.isEmpty(token) || isValidColumnName(token)) {
break; return;
default: }
verifyColumnName(segment); // accept only a small subset of keywords
if(SQLiteTokenizer.isKeyword(token)){
switch (token.toUpperCase(Locale.ROOT)) {
case "ASC":
case "DESC":
case "COLLATE":
case "NOCASE":
return;
} }
} }
// if none of the above, invalid token
throw new IllegalArgumentException("Invalid token " + token);
} }
public static void verifyWhere(@Nullable String where) { public static void verifyWhere(@Nullable String where) {
if (where == null) { if (where == null) {
return; return;
} }
SQLiteTokenizer.tokenize(where, SQLiteTokenizer.OPTION_NONE, VerificationUtils::verifyToken); SQLiteTokenizer.tokenize(where, SQLiteTokenizer.OPTION_NONE, VerificationUtils::verifyWhereToken);
} }
private static void verifyToken(String token) { private static void verifyWhereToken(String token) {
// allow empty, valid column names, functions (min,max,count) and types // allow empty, valid column names, functions (min,max,count) and types
if (TextUtils.isEmpty(token) || isValidColumnName(token) if (TextUtils.isEmpty(token) || isValidColumnName(token)
|| SQLiteTokenizer.isFunction(token) || SQLiteTokenizer.isType(token)) { || SQLiteTokenizer.isFunction(token) || SQLiteTokenizer.isType(token)) {
@ -1125,7 +1134,7 @@ public class FileContentProvider extends ContentProvider {
// Disallow dangerous keywords, allow others // Disallow dangerous keywords, allow others
if (SQLiteTokenizer.isKeyword(token)) { if (SQLiteTokenizer.isKeyword(token)) {
switch (token.toUpperCase(Locale.US)) { switch (token.toUpperCase(Locale.ROOT)) {
case "SELECT": case "SELECT":
case "FROM": case "FROM":
case "WHERE": case "WHERE":