CVE-2014-8682: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2014-11-21T15:59Z
Repository: https://github.com/gogits/gogs
Language: Go
Files changed: cmd/web.go, conf/app.ini, gogs.go, models/repo.go, models/user.go, modules/setting/setting.go, templates/.VERSION
Commit date: 2014-11-04 11:37:15 -0500
Commit message: fix session API broken and SQL pretection

Diff: diff --git a/cmd/web.go b/cmd/web.go
index d59ab52e..dc89fed7 100644
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -70,11 +70,11 @@ func checkVersion() {
 	i18nVer := git.MustParseVersion(i18n.Version())
 	if i18nVer.LessThan(git.MustParseVersion("0.0.2")) {
 		log.Fatal(4, "Package i18n version is too old, did you forget to update?(github.com/macaron-contrib/i18n)")
 	}
 	sessionVer := git.MustParseVersion(session.Version())
-	if sessionVer.LessThan(git.MustParseVersion("0.0.3")) {
+	if sessionVer.LessThan(git.MustParseVersion("0.0.5")) {
 		log.Fatal(4, "Package session version is too old, did you forget to update?(github.com/macaron-contrib/session)")
 	}
 }
 
 // newMacaron initializes Macaron instance.
diff --git a/conf/app.ini b/conf/app.ini
index ed4a1b62..014411ce 100644
--- a/conf/app.ini
+++ b/conf/app.ini
@@ -161,14 +161,10 @@ COOKIE_SECURE = false
 ENABLE_SET_COOKIE = true
 ; Session GC time interval, default is 86400
 GC_INTERVAL_TIME = 86400
 ; Session life time, default is 86400
 SESSION_LIFE_TIME = 86400
-; session id hash func, Either "sha1", "sha256" or "md5" default is sha1
-SESSION_ID_HASHFUNC = sha1
-; Session hash key, default is use random string
-SESSION_ID_HASHKEY =
 
 [picture]
 ; The place to picture data, either "server" or "qiniu", default is "server"
 SERVICE = server
 DISABLE_GRAVATAR = false
diff --git a/gogs.go b/gogs.go
index f46a7cd0..5e817cc2 100644
--- a/gogs.go
+++ b/gogs.go
@@ -15,11 +15,11 @@ import (
 
 	"github.com/gogits/gogs/cmd"
 	"github.com/gogits/gogs/modules/setting"
 )
 
-const APP_VER = "0.5.6.1102 Beta"
+const APP_VER = "0.5.6.1104 Beta"
 
 func init() {
 	runtime.GOMAXPROCS(runtime.NumCPU())
 	setting.AppVer = APP_VER
 }
diff --git a/models/repo.go b/models/repo.go
index 888dea1e..37cc7eab 100644
--- a/models/repo.go
+++ b/models/repo.go
@@ -1159,11 +1159,11 @@ func SearchRepositoryByName(opt SearchOption) (repos []*Repository, err error) {
 		sess.Where("owner_id=?", opt.Uid)
 	}
 	if !opt.Private {
 		sess.And("is_private=false")
 	}
-	sess.And("lower_name like '%" + opt.Keyword + "%'").Find(&repos)
+	sess.And("lower_name like ?", "%"+opt.Keyword+"%").Find(&repos)
 	return repos, err
 }
 
 //  __      __         __         .__
 // /  \    /  \_____ _/  |_  ____ |  |__
diff --git a/models/user.go b/models/user.go
index ce85008b..e7e6ed40 100644
--- a/models/user.go
+++ b/models/user.go
@@ -579,11 +579,11 @@ func SearchUserByName(opt SearchOption) (us []*User, err error) {
 		return us, nil
 	}
 	opt.Keyword = strings.ToLower(opt.Keyword)
 
 	us = make([]*User, 0, opt.Limit)
-	err = x.Limit(opt.Limit).Where("type=0").And("lower_name like '%" + opt.Keyword + "%'").Find(&us)
+	err = x.Limit(opt.Limit).Where("type=0").And("lower_name like ?", "%"+opt.Keyword+"%").Find(&us)
 	return us, err
 }
 
 // Follow is connection request for receiving user notifycation.
 type Follow struct {
diff --git a/modules/setting/setting.go b/modules/setting/setting.go
index 64c32ec7..99116fff 100644
--- a/modules/setting/setting.go
+++ b/modules/setting/setting.go
@@ -392,13 +392,10 @@ func newSessionService() {
 	SessionConfig.CookiePath = AppSubUrl
 	SessionConfig.Secure = Cfg.MustBool("session", "COOKIE_SECURE")
 	SessionConfig.EnableSetCookie = Cfg.MustBool("session", "ENABLE_SET_COOKIE", true)
 	SessionConfig.Gclifetime = Cfg.MustInt64("session", "GC_INTERVAL_TIME", 86400)
 	SessionConfig.Maxlifetime = Cfg.MustInt64("session", "SESSION_LIFE_TIME", 86400)
-	SessionConfig.SessionIDHashFunc = Cfg.MustValueRange("session", "SESSION_ID_HASHFUNC",
-		"sha1", []string{"sha1", "sha256", "md5"})
-	SessionConfig.SessionIDHashKey = Cfg.MustValue("session", "SESSION_ID_HASHKEY", string(com.RandomCreateBytes(16)))
 
 	if SessionProvider == "file" {
 		os.MkdirAll(path.Dir(SessionConfig.ProviderConfig), os.ModePerm)
 	}
 
diff --git a/templates/.VERSION b/templates/.VERSION
index c6d37157..188756b2 100644
--- a/templates/.VERSION
+++ b/templates/.VERSION
@@ -1 +1 @@
-0.5.6.1102 Beta
\ No newline at end of file
+0.5.6.1104 Beta
\ No newline at end of file

Vulnerable code: 	if sessionVer.LessThan(git.MustParseVersion("0.0.3")) {
; session id hash func, Either "sha1", "sha256" or "md5" default is sha1
SESSION_ID_HASHFUNC = sha1
; Session hash key, default is use random string
SESSION_ID_HASHKEY =
const APP_VER = "0.5.6.1102 Beta"
	sess.And("lower_name like '%" + opt.Keyword + "%'").Find(&repos)
	err = x.Limit(opt.Limit).Where("type=0").And("lower_name like '%" + opt.Keyword + "%'").Find(&us)
	SessionConfig.SessionIDHashFunc = Cfg.MustValueRange("session", "SESSION_ID_HASHFUNC",
		"sha1", []string{"sha1", "sha256", "md5"})
	SessionConfig.SessionIDHashKey = Cfg.MustValue("session", "SESSION_ID_HASHKEY", string(com.RandomCreateBytes(16)))
0.5.6.1102 Beta
Fixed code: 	if sessionVer.LessThan(git.MustParseVersion("0.0.5")) {
const APP_VER = "0.5.6.1104 Beta"
	sess.And("lower_name like ?", "%"+opt.Keyword+"%").Find(&repos)
	err = x.Limit(opt.Limit).Where("type=0").And("lower_name like ?", "%"+opt.Keyword+"%").Find(&us)
0.5.6.1104 Beta