Mirrors/stash
1
0
Fork 0
mirror of https://github.com/stashapp/stash.git synced 2025-12-17 20:34:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

Enforce whitelist for sort values (#4865)

Browse Source
This commit is contained in:
WithoutPants
2024-05-22 14:59:08 +10:00
committed by GitHub
parent 865208844c
commit 89553864f5
11 changed files with 275 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
pkg/sqlite/scene_marker.go
View File

@@ -310,7 +310,9 @@ func (qb *SceneMarkerStore) makeQuery(ctx context.Context, sceneMarkerFilter *mo
return nil, err
}
qb.setSceneMarkerSort(&query, findFilter)
if err := qb.setSceneMarkerSort(&query, findFilter); err != nil {
return nil, err
}
query.sortAndPagination += getPagination(findFilter)
return &query, nil
@@ -473,10 +475,26 @@ func sceneMarkerPerformersCriterionHandler(qb *SceneMarkerStore, performers *mod
}
}
func (qb *SceneMarkerStore) setSceneMarkerSort(query *queryBuilder, findFilter *models.FindFilterType) {
var sceneMarkerSortOptions = sortOptions{
"created_at",
"id",
"title",
"random",
"scene_id",
"scenes_updated_at",
"seconds",
"updated_at",
}
func (qb *SceneMarkerStore) setSceneMarkerSort(query *queryBuilder, findFilter *models.FindFilterType) error {
sort := findFilter.GetSort("title")
direction := findFilter.GetDirection()
// CVE-2024-32231 - ensure sort is in the list of allowed sorts
if err := sceneMarkerSortOptions.validateSort(sort); err != nil {
return err
}
switch sort {
case "scenes_updated_at":
sort = "updated_at"
@@ -490,6 +508,7 @@ func (qb *SceneMarkerStore) setSceneMarkerSort(query *queryBuilder, findFilter *
}
query.sortAndPagination += ", scene_markers.scene_id ASC, scene_markers.seconds ASC"
return nil
}
func (qb *SceneMarkerStore) querySceneMarkers(ctx context.Context, query string, args []interface{}) ([]*models.SceneMarker, error) {