Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

修复插件shell命令注入漏洞 #1316

Merged
merged 3 commits into from
Jan 8, 2022
Merged

修复插件shell命令注入漏洞 #1316

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
98e353a
修复插件shell命令注入漏洞
nick2wang Jan 5, 2022
abda4c1
修复插件shell命令注入漏洞 - 通过实例信息注入
nick2wang Jan 5, 2022
7a99579
Merge branch 'master' into nick-patch2
nick2wang Jan 6, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions sql/binlog.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
import os
import time
import traceback
import shlex

import simplejson as json
from django.conf import settings
Expand Down Expand Up @@ -112,7 +113,8 @@ def binlog2sql(request):
# 提交给binlog2sql进行解析
binlog2sql = Binlog2Sql()
# 准备参数
args = {"conn_options": fr"-h{instance.host} -u{instance.user} -p'{instance.password}' -P{instance.port} ",
args = {"conn_options": fr"-h{shlex.quote(str(instance.host))} -u{shlex.quote(str(instance.user))} \
-p'{shlex.quote(str(instance.password))}' -P{shlex.quote(str(instance.port))} ",
"stop_never": False,
"no-primary-key": no_pk,
"flashback": flashback,
Expand Down Expand Up @@ -190,7 +192,8 @@ def binlog2sql_file(args, user):
"""
binlog2sql = Binlog2Sql()
instance = args.get('instance')
conn_options = fr"-h{instance.host} -u{instance.user} -p'{instance.password}' -P{instance.port}"
conn_options = fr"-h{shlex.quote(str(instance.host))} -u{shlex.quote(str(instance.user))} \
-p'{shlex.quote(str(instance.password))}' -P{shlex.quote(str(instance.port))} ",
args['conn_options'] = conn_options
timestamp = int(time.time())
path = os.path.join(settings.BASE_DIR, 'downloads/binlog2sql/')
Expand Down
16 changes: 8 additions & 8 deletions sql/instance.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,15 +201,15 @@ def schemasync(request):
"sync-comments": sync_comments,
"tag": tag,
"output-directory": output_directory,
"source": r"mysql://{user}:'{pwd}'@{host}:{port}/{database}".format(user=instance_info.user,
pwd=instance_info.password,
host=instance_info.host,
port=instance_info.port,
"source": r"mysql://{user}:'{pwd}'@{host}:{port}/{database}".format(user=shlex.quote(str(instance_info.user)),
pwd=shlex.quote(str(instance_info.password)),
host=shlex.quote(str(instance_info.host)),
port=shlex.quote(str(instance_info.port)),
database=db_name),
"target": r"mysql://{user}:'{pwd}'@{host}:{port}/{database}".format(user=target_instance_info.user,
pwd=target_instance_info.password,
host=target_instance_info.host,
port=target_instance_info.port,
"target": r"mysql://{user}:'{pwd}'@{host}:{port}/{database}".format(user=shlex.quote(str(target_instance_info.user)),
pwd=shlex.quote(str(target_instance_info.password)),
host=shlex.quote(str(target_instance_info.host)),
port=shlex.quote(str(target_instance_info.port)),
database=target_db_name)
}
# 参数检查
Expand Down
2 changes: 1 addition & 1 deletion sql/plugins/binglog2sql.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ def generate_args2cmd(self, args, shell):
'start-datetime', 'stop-datetime']
filter_options = ['databases', 'tables', 'only-dml', 'sql-type']
if shell:
cmd_args = f'python {self.path}' if self.path else ''
cmd_args = f'python {shlex.quote(str(self.path))}' if self.path else ''
for name, value in args.items():
if name in conn_options:
cmd_args += f' {value}'
Expand Down
2 changes: 1 addition & 1 deletion sql/plugins/soar.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ def generate_args2cmd(self, args, shell):
:return:
"""
if shell:
cmd_args = self.path if self.path else ''
cmd_args = shlex.quote(str(self.path)) if self.path else ''
for name, value in args.items():
cmd_args += f" -{name}={shlex.quote(str(value))}"
else:
Expand Down
2 changes: 1 addition & 1 deletion sql/plugins/sqladvisor.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ def generate_args2cmd(self, args, shell):
:return:
"""
if shell:
cmd_args = self.path if self.path else ''
cmd_args = shlex.quote(str(self.path)) if self.path else ''
for name, value in args.items():
cmd_args += f" -{name} {shlex.quote(str(value))}"
else:
Expand Down