ben.carrasco/freeswitch
1
0 Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2026-11-15 05:48:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

prevent sql injection by using sqlite formatter on various code that generates sql stmts with switch_snprintf

Browse Source
This commit is contained in:
Anthony Minessale committed 2011-09-29 08:28:12 -05:00
1 parent cbfe83cc8f
commit 256a6264d4
4 files changed
+37 -37
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/switch_core_sqldb.c
+3 -3
View File
@@ -733,7 +733,7 @@ SWITCH_DECLARE(switch_status_t) switch_cache_db_persistant_execute_trans(switch_
if ((result = switch_odbc_SQLSetAutoCommitAttr(dbh->native_handle.odbc_dbh, 0)) != SWITCH_ODBC_SUCCESS) {
char tmp[100];
switch_snprintf(tmp, sizeof(tmp), "%s-%i", "Unable to Set AutoCommit Off", result);
switch_snprintfv(tmp, sizeof(tmp), "%q-%i", "Unable to Set AutoCommit Off", result);
errmsg = strdup(tmp);
}
}
@@ -1144,7 +1144,7 @@ static char *parse_presence_data_cols(switch_event_t *event)
SWITCH_STANDARD_STREAM(stream);
for (i = 0; i < col_count; i++) {
switch_snprintf(col_name, sizeof(col_name), "variable_%s", cols[i]);
switch_snprintfv(col_name, sizeof(col_name), "variable_%q", cols[i]);
stream.write_function(&stream, "%q='%q',", cols[i], switch_event_get_header_nil(event, col_name));
}
@@ -1906,7 +1906,7 @@ switch_status_t switch_core_sqldb_start(switch_memory_pool_t *pool, switch_bool_
const char *hostname = switch_core_get_switchname();
for (i = 0; tables[i]; i++) {
switch_snprintf(sql, sizeof(sql), "delete from %s where hostname='%s'", tables[i], hostname);
switch_snprintfv(sql, sizeof(sql), "delete from %q where hostname='%q'", tables[i], hostname);
switch_cache_db_execute_sql(dbh, sql, NULL);
}
}