killbill-memoizeit

search: prevent SQL injection Signed-off-by: Pierre-Alexandre

1/29/2014 2:29:33 PM

Details

diff --git a/account/src/main/java/com/ning/billing/account/dao/AccountSqlDao.java b/account/src/main/java/com/ning/billing/account/dao/AccountSqlDao.java
index 4cfd258..dd1d652 100644
--- a/account/src/main/java/com/ning/billing/account/dao/AccountSqlDao.java
+++ b/account/src/main/java/com/ning/billing/account/dao/AccountSqlDao.java
@@ -23,7 +23,6 @@ import org.skife.jdbi.v2.sqlobject.Bind;
 import org.skife.jdbi.v2.sqlobject.BindBean;
 import org.skife.jdbi.v2.sqlobject.SqlQuery;
 import org.skife.jdbi.v2.sqlobject.SqlUpdate;
-import org.skife.jdbi.v2.sqlobject.customizers.Define;
 import org.skife.jdbi.v2.sqlobject.customizers.FetchSize;
 
 import com.ning.billing.account.api.Account;
@@ -45,7 +44,8 @@ public interface AccountSqlDao extends EntitySqlDao<AccountModelDao, Account> {
     // Magic value to force MySQL to stream from the database
     // See http://dev.mysql.com/doc/refman/5.0/en/connector-j-reference-implementation-notes.html (ResultSet)
     @FetchSize(Integer.MIN_VALUE)
-    public Iterator<AccountModelDao> searchAccounts(@Define("searchKey") final String searchKey,
+    public Iterator<AccountModelDao> searchAccounts(@Bind("searchKey") final String searchKey,
+                                                    @Bind("likeSearchKey") final String likeSearchKey,
                                                     @Bind("offset") final Long offset,
                                                     @Bind("rowCount") final Long rowCount,
                                                     @BindBean final InternalTenantContext context);
diff --git a/account/src/main/java/com/ning/billing/account/dao/DefaultAccountDao.java b/account/src/main/java/com/ning/billing/account/dao/DefaultAccountDao.java
index 3ce879e..ea710c3 100644
--- a/account/src/main/java/com/ning/billing/account/dao/DefaultAccountDao.java
+++ b/account/src/main/java/com/ning/billing/account/dao/DefaultAccountDao.java
@@ -112,7 +112,7 @@ public class DefaultAccountDao extends EntityDaoBase<AccountModelDao, Account, A
                                               new PaginationIteratorBuilder<AccountModelDao, Account, AccountSqlDao>() {
                                                   @Override
                                                   public Iterator<AccountModelDao> build(final AccountSqlDao accountSqlDao, final Long limit) {
-                                                      return accountSqlDao.searchAccounts(searchKey, offset, limit, context);
+                                                      return accountSqlDao.searchAccounts(searchKey, String.format("%%%s%%", searchKey), offset, limit, context);
                                                   }
                                               },
                                               offset,
diff --git a/account/src/main/resources/com/ning/billing/account/dao/AccountSqlDao.sql.stg b/account/src/main/resources/com/ning/billing/account/dao/AccountSqlDao.sql.stg
index 10d4edc..c1e5255 100644
--- a/account/src/main/resources/com/ning/billing/account/dao/AccountSqlDao.sql.stg
+++ b/account/src/main/resources/com/ning/billing/account/dao/AccountSqlDao.sql.stg
@@ -86,17 +86,17 @@ getAccountByKey() ::= <<
     where external_key = :externalKey <AND_CHECK_TENANT()>;
 >>
 
-searchAccounts(searchKey, offset, rowCount) ::= <<
+searchAccounts() ::= <<
 select SQL_CALC_FOUND_ROWS
 <allTableFields("t.")>
 from <tableName()> t
 where 1 = 1
 and (
-     <idField("t.")> = '<searchKey>'
-  or t.name like '%<searchKey>%'
-  or t.email like '%<searchKey>%'
-  or t.external_key like '%<searchKey>%'
-  or t.company_name like '%<searchKey>%'
+     <idField("t.")> = :searchKey
+  or t.name like :likeSearchKey
+  or t.email like :likeSearchKey
+  or t.external_key like :likeSearchKey
+  or t.company_name like :likeSearchKey
 )
 <AND_CHECK_TENANT("t.")>
 order by <recordIdField("t.")> ASC
diff --git a/payment/src/main/java/com/ning/billing/payment/dao/PaymentMethodSqlDao.java b/payment/src/main/java/com/ning/billing/payment/dao/PaymentMethodSqlDao.java
index d5af8bf..3ad3b72 100644
--- a/payment/src/main/java/com/ning/billing/payment/dao/PaymentMethodSqlDao.java
+++ b/payment/src/main/java/com/ning/billing/payment/dao/PaymentMethodSqlDao.java
@@ -23,7 +23,6 @@ import org.skife.jdbi.v2.sqlobject.Bind;
 import org.skife.jdbi.v2.sqlobject.BindBean;
 import org.skife.jdbi.v2.sqlobject.SqlQuery;
 import org.skife.jdbi.v2.sqlobject.SqlUpdate;
-import org.skife.jdbi.v2.sqlobject.customizers.Define;
 import org.skife.jdbi.v2.sqlobject.customizers.FetchSize;
 
 import com.ning.billing.callcontext.InternalCallContext;
diff --git a/util/src/main/java/com/ning/billing/util/customfield/dao/CustomFieldSqlDao.java b/util/src/main/java/com/ning/billing/util/customfield/dao/CustomFieldSqlDao.java
index 1961d2b..c257b74 100644
--- a/util/src/main/java/com/ning/billing/util/customfield/dao/CustomFieldSqlDao.java
+++ b/util/src/main/java/com/ning/billing/util/customfield/dao/CustomFieldSqlDao.java
@@ -24,7 +24,6 @@ import org.skife.jdbi.v2.sqlobject.Bind;
 import org.skife.jdbi.v2.sqlobject.BindBean;
 import org.skife.jdbi.v2.sqlobject.SqlQuery;
 import org.skife.jdbi.v2.sqlobject.SqlUpdate;
-import org.skife.jdbi.v2.sqlobject.customizers.Define;
 import org.skife.jdbi.v2.sqlobject.customizers.FetchSize;
 
 import com.ning.billing.ObjectType;
@@ -53,7 +52,8 @@ public interface CustomFieldSqlDao extends EntitySqlDao<CustomFieldModelDao, Cus
     // Magic value to force MySQL to stream from the database
     // See http://dev.mysql.com/doc/refman/5.0/en/connector-j-reference-implementation-notes.html (ResultSet)
     @FetchSize(Integer.MIN_VALUE)
-    public Iterator<CustomFieldModelDao> searchCustomFields(@Define("searchKey") final String searchKey,
+    public Iterator<CustomFieldModelDao> searchCustomFields(@Bind("searchKey") final String searchKey,
+                                                            @Bind("likeSearchKey") final String likeSearchKey,
                                                             @Bind("offset") final Long offset,
                                                             @Bind("rowCount") final Long rowCount,
                                                             @BindBean final InternalTenantContext context);
diff --git a/util/src/main/java/com/ning/billing/util/customfield/dao/DefaultCustomFieldDao.java b/util/src/main/java/com/ning/billing/util/customfield/dao/DefaultCustomFieldDao.java
index 8eaf2a0..092d95a 100644
--- a/util/src/main/java/com/ning/billing/util/customfield/dao/DefaultCustomFieldDao.java
+++ b/util/src/main/java/com/ning/billing/util/customfield/dao/DefaultCustomFieldDao.java
@@ -148,7 +148,7 @@ public class DefaultCustomFieldDao extends EntityDaoBase<CustomFieldModelDao, Cu
                                               new PaginationIteratorBuilder<CustomFieldModelDao, CustomField, CustomFieldSqlDao>() {
                                                   @Override
                                                   public Iterator<CustomFieldModelDao> build(final CustomFieldSqlDao customFieldSqlDao, final Long limit) {
-                                                      return customFieldSqlDao.searchCustomFields(searchKey, offset, limit, context);
+                                                      return customFieldSqlDao.searchCustomFields(searchKey, String.format("%%%s%%", searchKey), offset, limit, context);
                                                   }
                                               },
                                               offset,
diff --git a/util/src/main/java/com/ning/billing/util/tag/dao/DefaultTagDao.java b/util/src/main/java/com/ning/billing/util/tag/dao/DefaultTagDao.java
index e559df7..4a4abaa 100644
--- a/util/src/main/java/com/ning/billing/util/tag/dao/DefaultTagDao.java
+++ b/util/src/main/java/com/ning/billing/util/tag/dao/DefaultTagDao.java
@@ -223,7 +223,7 @@ public class DefaultTagDao extends EntityDaoBase<TagModelDao, Tag, TagApiExcepti
                                               new PaginationIteratorBuilder<TagModelDao, Tag, TagSqlDao>() {
                                                   @Override
                                                   public Iterator<TagModelDao> build(final TagSqlDao tagSqlDao, final Long limit) {
-                                                      return tagSqlDao.searchTags(searchKey, offset, limit, context);
+                                                      return tagSqlDao.searchTags(searchKey, String.format("%%%s%%", searchKey), offset, limit, context);
                                                   }
                                               },
                                               offset,
diff --git a/util/src/main/java/com/ning/billing/util/tag/dao/TagSqlDao.java b/util/src/main/java/com/ning/billing/util/tag/dao/TagSqlDao.java
index 53ebbc5..668553b 100644
--- a/util/src/main/java/com/ning/billing/util/tag/dao/TagSqlDao.java
+++ b/util/src/main/java/com/ning/billing/util/tag/dao/TagSqlDao.java
@@ -24,7 +24,6 @@ import org.skife.jdbi.v2.sqlobject.Bind;
 import org.skife.jdbi.v2.sqlobject.BindBean;
 import org.skife.jdbi.v2.sqlobject.SqlQuery;
 import org.skife.jdbi.v2.sqlobject.SqlUpdate;
-import org.skife.jdbi.v2.sqlobject.customizers.Define;
 import org.skife.jdbi.v2.sqlobject.customizers.FetchSize;
 
 import com.ning.billing.ObjectType;
@@ -58,7 +57,8 @@ public interface TagSqlDao extends EntitySqlDao<TagModelDao, Tag> {
     // Magic value to force MySQL to stream from the database
     // See http://dev.mysql.com/doc/refman/5.0/en/connector-j-reference-implementation-notes.html (ResultSet)
     @FetchSize(Integer.MIN_VALUE)
-    public Iterator<TagModelDao> searchTags(@Define("searchKey") final String searchKey,
+    public Iterator<TagModelDao> searchTags(@Bind("searchKey") final String searchKey,
+                                            @Bind("likeSearchKey") final String likeSearchKey,
                                             @Bind("offset") final Long offset,
                                             @Bind("rowCount") final Long rowCount,
                                             @BindBean final InternalTenantContext context);
diff --git a/util/src/main/resources/com/ning/billing/util/customfield/dao/CustomFieldSqlDao.sql.stg b/util/src/main/resources/com/ning/billing/util/customfield/dao/CustomFieldSqlDao.sql.stg
index 0367199..1d01add 100644
--- a/util/src/main/resources/com/ning/billing/util/customfield/dao/CustomFieldSqlDao.sql.stg
+++ b/util/src/main/resources/com/ning/billing/util/customfield/dao/CustomFieldSqlDao.sql.stg
@@ -52,16 +52,16 @@ and is_active
 ;
 >>
 
-searchCustomFields(searchKey, offset, rowCount) ::= <<
+searchCustomFields() ::= <<
 select SQL_CALC_FOUND_ROWS
 <allTableFields("t.")>
 from <tableName()> t
 where 1 = 1
 and (
-     <idField("t.")> = '<searchKey>'
-  or t.object_type like '%<searchKey>%'
-  or t.field_name like '%<searchKey>%'
-  or t.field_value like '%<searchKey>%'
+     <idField("t.")> = :searchKey
+  or t.object_type like :likeSearchKey
+  or t.field_name like :likeSearchKey
+  or t.field_value like :likeSearchKey
 )
 <AND_CHECK_TENANT("t.")>
 order by <recordIdField("t.")> ASC
diff --git a/util/src/main/resources/com/ning/billing/util/tag/dao/TagSqlDao.sql.stg b/util/src/main/resources/com/ning/billing/util/tag/dao/TagSqlDao.sql.stg
index 7b14556..5bad309 100644
--- a/util/src/main/resources/com/ning/billing/util/tag/dao/TagSqlDao.sql.stg
+++ b/util/src/main/resources/com/ning/billing/util/tag/dao/TagSqlDao.sql.stg
@@ -58,17 +58,17 @@ and t.object_type = :objectType
 ;
 >>
 
-searchTags(searchKey, offset, rowCount) ::= <<
+searchTags() ::= <<
 select SQL_CALC_FOUND_ROWS
 <allTableFields("t.")>
 from <tableName()> t
 join tag_definitions td on td.id = t.tag_definition_id
 where 1 = 1
 and (
-     <idField("t.")> = '<searchKey>'
-  or t.object_type like '%<searchKey>%'
-  or td.name like '%<searchKey>%'
-  or td.description like '%<searchKey>%'
+     <idField("t.")> = :searchKey
+  or t.object_type like :likeSearchKey
+  or td.name like :likeSearchKey
+  or td.description like :likeSearchKey
 )
 <AND_CHECK_TENANT("t.")>
 order by <recordIdField("t.")> ASC