Project: datamanagement
Issue DM-794: SQL injection in czar/proxy.py
Running automated tests for some queries I observe python exceptions in czar log which look like this: {code} 20140529 19:47:19.364371 0x7faacc003550 INF Query dispatch (7) toUnhandled exception in thread started by Traceback (most recent call last): File "/usr/local/home/salnikov/qserv-master/build/dist/lib/python/lsst/qserv/czar/proxy.py", line 78, in waitAndUnlock lock.unlock() File "/usr/local/home/salnikov/qserv-master/build/dist/lib/python/lsst/qserv/czar/proxy.py", line 65, in unlock self._saveQueryMessages() File "/usr/local/home/salnikov/qserv-master/build/dist/lib/python/lsst/qserv/czar/proxy.py", line 87, in _saveQueryMessages self.db.applySql(Lock.writeTmpl % (self._tableName, chunkId, code, msg, timestamp)) File "/usr/local/home/salnikov/qserv-master/build/dist/lib/python/lsst/qserv/czar/db.py", line 95, in applySql c.execute(sql) File "/u2/salnikov/STACK/Linux64/mysqlpython/1.2.3+8/lib/python/MySQL_python-1.2.3-py2.7-linux-x86_64.egg/MySQLdb/cursors.py", line 174, in execute self.errorhandler(self, exc, value) File "/u2/salnikov/STACK/Linux64/mysqlpython/1.2.3+8/lib/python/MySQL_python-1.2.3-py2.7-linux-x86_64.egg/MySQLdb/connections.py", line 36, in defaulterrorhandler raise errorclass, errorvalue _mysql_exceptions.ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'r' AND sce.tract=0 AND sce.patch='159,3';', 1401410839.000000)' at line 1") ok 0.000532 seconds {code} I believe this is due to how query string is being constructed in czar/proxy.py: {code:py} class Lock: writeTmpl = "INSERT INTO %s VALUES (%d, %d, '%s', %f);" # ................... self.db.applySql(Lock.writeTmpl % (self._tableName, chunkId, code, msg, timestamp)) {code} If {{msg}} happens to contain quotes then resulting query is broken. One should not use Python formatting to construct query strings, instead the parameters should be passed directly to {{cursor.execute()}} method.
Story points: 2