修复插件shell命令注入漏洞 (#1316)

* 修复插件shell命令注入漏洞
hhyo · Jan 8, 2022 · 42e1d12 · 42e1d12
1 parent f5292f4
commit 42e1d12
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 11 deletions.
diff --git a/sql/instance.py b/sql/instance.py
@@ -201,15 +201,15 @@ def schemasync(request):
         "sync-comments": sync_comments,
         "tag": tag,
         "output-directory": output_directory,
-        "source": r"mysql://{user}:'{pwd}'@{host}:{port}/{database}".format(user=instance_info.user,
-                                                                            pwd=instance_info.password,
-                                                                            host=instance_info.host,
-                                                                            port=instance_info.port,
+        "source": r"mysql://{user}:'{pwd}'@{host}:{port}/{database}".format(user=shlex.quote(str(instance_info.user)),
+                                                                            pwd=shlex.quote(str(instance_info.password)),
+                                                                            host=shlex.quote(str(instance_info.host)),
+                                                                            port=shlex.quote(str(instance_info.port)),
                                                                             database=db_name),
-        "target": r"mysql://{user}:'{pwd}'@{host}:{port}/{database}".format(user=target_instance_info.user,
-                                                                            pwd=target_instance_info.password,
-                                                                            host=target_instance_info.host,
-                                                                            port=target_instance_info.port,
+        "target": r"mysql://{user}:'{pwd}'@{host}:{port}/{database}".format(user=shlex.quote(str(target_instance_info.user)),
+                                                                            pwd=shlex.quote(str(target_instance_info.password)),
+                                                                            host=shlex.quote(str(target_instance_info.host)),
+                                                                            port=shlex.quote(str(target_instance_info.port)),
                                                                             database=target_db_name)
     }
     # 参数检查

diff --git a/sql/plugins/binglog2sql.py b/sql/plugins/binglog2sql.py
@@ -33,7 +33,7 @@ def generate_args2cmd(self, args, shell):
                          'start-datetime', 'stop-datetime']
         filter_options = ['databases', 'tables', 'only-dml', 'sql-type']
         if shell:
-            cmd_args = f'python {self.path}' if self.path else ''
+            cmd_args = f'python {shlex.quote(str(self.path))}' if self.path else ''
             for name, value in args.items():
                 if name in conn_options:
                     cmd_args += f' {value}'

diff --git a/sql/plugins/soar.py b/sql/plugins/soar.py
@@ -28,7 +28,7 @@ def generate_args2cmd(self, args, shell):
         :return:
         """
         if shell:
-            cmd_args = self.path if self.path else ''
+            cmd_args = shlex.quote(str(self.path)) if self.path else ''
             for name, value in args.items():
                 cmd_args += f" -{name}={shlex.quote(str(value))}"
         else:

diff --git a/sql/plugins/sqladvisor.py b/sql/plugins/sqladvisor.py
@@ -27,7 +27,7 @@ def generate_args2cmd(self, args, shell):
         :return:
         """
         if shell:
-            cmd_args = self.path if self.path else ''
+            cmd_args = shlex.quote(str(self.path)) if self.path else ''
             for name, value in args.items():
                 cmd_args += f" -{name} {shlex.quote(str(value))}"
         else: