Mirrors/stash
1
0
Fork 0
mirror of https://github.com/stashapp/stash.git synced 2025-12-17 04:14:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

Enforce whitelist for sort values (#4865)

Browse Source
This commit is contained in:
WithoutPants
2024-05-22 14:59:08 +10:00
committed by GitHub
parent 865208844c
commit 89553864f5
11 changed files with 275 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
pkg/sqlite/performer.go
View File

@@ -706,7 +706,12 @@ func (qb *PerformerStore) makeQuery(ctx context.Context, performerFilter *models
return nil, err
}
query.sortAndPagination = qb.getPerformerSort(findFilter) + getPagination(findFilter)
var err error
query.sortAndPagination, err = qb.getPerformerSort(findFilter)
if err != nil {
return nil, err
}
query.sortAndPagination += getPagination(findFilter)
return &query, nil
}
@@ -1113,7 +1118,27 @@ func (qb *PerformerStore) sortByLastPlayedAt(direction string) string {
return " ORDER BY (" + selectPerformerLastPlayedAtSQL + ") " + direction
}
func (qb *PerformerStore) getPerformerSort(findFilter *models.FindFilterType) string {
var performerSortOptions = sortOptions{
"birthdate",
"created_at",
"galleries_count",
"height",
"id",
"images_count",
"last_o_at",
"last_played_at",
"name",
"o_counter",
"penis_length",
"play_count",
"random",
"rating",
"scenes_count",
"tag_count",
"updated_at",
}
func (qb *PerformerStore) getPerformerSort(findFilter *models.FindFilterType) (string, error) {
var sort string
var direction string
if findFilter == nil {
@@ -1124,6 +1149,11 @@ func (qb *PerformerStore) getPerformerSort(findFilter *models.FindFilterType) st
direction = findFilter.GetDirection()
}
// CVE-2024-32231 - ensure sort is in the list of allowed sorts
if err := performerSortOptions.validateSort(sort); err != nil {
return "", err
}
sortQuery := ""
switch sort {
case "tag_count":
@@ -1148,7 +1178,7 @@ func (qb *PerformerStore) getPerformerSort(findFilter *models.FindFilterType) st
// Whatever the sorting, always use name/id as a final sort
sortQuery += ", COALESCE(performers.name, performers.id) COLLATE NATURAL_CI ASC"
return sortQuery
return sortQuery, nil
}
func (qb *PerformerStore) tagsRepository() *joinRepository {