From ca7ec5748080bf1b6727110839d2fb27e2b25027 Mon Sep 17 00:00:00 2001 From: Christian Schwahn Date: Tue, 3 Sep 2019 14:10:55 +0200 Subject: [PATCH 1/7] fix: escape password to prevent bash sub commands and special chars --- .idea/.gitignore | 2 ++ .idea/Sitegeist.MagicWand.iml | 10 ++++++++++ .idea/misc.xml | 6 ++++++ .idea/modules.xml | 8 ++++++++ .idea/php.xml | 8 ++++++++ .idea/vcs.xml | 6 ++++++ Classes/DBAL/SimpleDBAL.php | 2 +- 7 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 .idea/.gitignore create mode 100644 .idea/Sitegeist.MagicWand.iml create mode 100644 .idea/misc.xml create mode 100644 .idea/modules.xml create mode 100644 .idea/php.xml create mode 100644 .idea/vcs.xml diff --git a/.idea/.gitignore b/.idea/.gitignore new file mode 100644 index 0000000..5c98b42 --- /dev/null +++ b/.idea/.gitignore @@ -0,0 +1,2 @@ +# Default ignored files +/workspace.xml \ No newline at end of file diff --git a/.idea/Sitegeist.MagicWand.iml b/.idea/Sitegeist.MagicWand.iml new file mode 100644 index 0000000..6d2b389 --- /dev/null +++ b/.idea/Sitegeist.MagicWand.iml @@ -0,0 +1,10 @@ + + + + + + + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000..28a804d --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,6 @@ + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 0000000..2b65113 --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/php.xml b/.idea/php.xml new file mode 100644 index 0000000..d7f610b --- /dev/null +++ b/.idea/php.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000..94a25f7 --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/Classes/DBAL/SimpleDBAL.php b/Classes/DBAL/SimpleDBAL.php index b5c4b68..158dc4a 100644 --- a/Classes/DBAL/SimpleDBAL.php +++ b/Classes/DBAL/SimpleDBAL.php @@ -40,7 +40,7 @@ public function buildCmd(string $driver, ?string $host, int $port, string $usern public function buildDumpCmd(string $driver, ?string $host, int $port, string $username, string $password, string $database): string { if ($driver === 'pdo_mysql') { - return sprintf('mysqldump --single-transaction --add-drop-table --host=%s --port=%d --user=%s --password=%s %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); + return sprintf('mysqldump --single-transaction --add-drop-table --host=%s --port=%d --user=%s --password=\'%s\ %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); } else if ($driver === 'pdo_pgsql') { return sprintf('PGPASSWORD=%s pg_dump --host=%s --port=%s --username=%s --dbname=%s --schema=public --no-owner --no-privileges', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); } From 22822adc49bed4890ec342f840d66e5d90d9b3ac Mon Sep 17 00:00:00 2001 From: Christian Schwahn Date: Tue, 3 Sep 2019 14:11:07 +0200 Subject: [PATCH 2/7] fix: escape password to prevent bash sub commands and special chars --- .idea/.gitignore | 2 -- .idea/Sitegeist.MagicWand.iml | 10 ---------- .idea/misc.xml | 6 ------ .idea/modules.xml | 8 -------- .idea/php.xml | 8 -------- .idea/vcs.xml | 6 ------ 6 files changed, 40 deletions(-) delete mode 100644 .idea/.gitignore delete mode 100644 .idea/Sitegeist.MagicWand.iml delete mode 100644 .idea/misc.xml delete mode 100644 .idea/modules.xml delete mode 100644 .idea/php.xml delete mode 100644 .idea/vcs.xml diff --git a/.idea/.gitignore b/.idea/.gitignore deleted file mode 100644 index 5c98b42..0000000 --- a/.idea/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -# Default ignored files -/workspace.xml \ No newline at end of file diff --git a/.idea/Sitegeist.MagicWand.iml b/.idea/Sitegeist.MagicWand.iml deleted file mode 100644 index 6d2b389..0000000 --- a/.idea/Sitegeist.MagicWand.iml +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - - - - - \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml deleted file mode 100644 index 28a804d..0000000 --- a/.idea/misc.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - - - \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml deleted file mode 100644 index 2b65113..0000000 --- a/.idea/modules.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - \ No newline at end of file diff --git a/.idea/php.xml b/.idea/php.xml deleted file mode 100644 index d7f610b..0000000 --- a/.idea/php.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml deleted file mode 100644 index 94a25f7..0000000 --- a/.idea/vcs.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file From 2df70d3a45de28d746bb0b4bf3954e0208cd7ddc Mon Sep 17 00:00:00 2001 From: Christian Schwahn Date: Wed, 4 Sep 2019 10:08:45 +0200 Subject: [PATCH 3/7] fix: false quoting --- .idea/Sitegeist.MagicWand.iml | 10 +++++ .idea/misc.xml | 6 +++ .idea/modules.xml | 8 ++++ .idea/php.xml | 8 ++++ .idea/vcs.xml | 6 +++ .idea/workspace.xml | 79 +++++++++++++++++++++++++++++++++++ Classes/DBAL/SimpleDBAL.php | 2 +- 7 files changed, 118 insertions(+), 1 deletion(-) create mode 100644 .idea/Sitegeist.MagicWand.iml create mode 100644 .idea/misc.xml create mode 100644 .idea/modules.xml create mode 100644 .idea/php.xml create mode 100644 .idea/vcs.xml create mode 100644 .idea/workspace.xml diff --git a/.idea/Sitegeist.MagicWand.iml b/.idea/Sitegeist.MagicWand.iml new file mode 100644 index 0000000..6d2b389 --- /dev/null +++ b/.idea/Sitegeist.MagicWand.iml @@ -0,0 +1,10 @@ + + + + + + + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000..28a804d --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,6 @@ + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 0000000..2b65113 --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/php.xml b/.idea/php.xml new file mode 100644 index 0000000..d5bc926 --- /dev/null +++ b/.idea/php.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000..94a25f7 --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/.idea/workspace.xml b/.idea/workspace.xml new file mode 100644 index 0000000..653c3b1 --- /dev/null +++ b/.idea/workspace.xml @@ -0,0 +1,79 @@ + + + + + + + + + $PROJECT_DIR$/composer.json + + + + + + + + + + + + + + + + + + + + + + + + + + 1567512488319 + + + + + + + + + \ No newline at end of file diff --git a/Classes/DBAL/SimpleDBAL.php b/Classes/DBAL/SimpleDBAL.php index 158dc4a..c21fcb4 100644 --- a/Classes/DBAL/SimpleDBAL.php +++ b/Classes/DBAL/SimpleDBAL.php @@ -40,7 +40,7 @@ public function buildCmd(string $driver, ?string $host, int $port, string $usern public function buildDumpCmd(string $driver, ?string $host, int $port, string $username, string $password, string $database): string { if ($driver === 'pdo_mysql') { - return sprintf('mysqldump --single-transaction --add-drop-table --host=%s --port=%d --user=%s --password=\'%s\ %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); + return sprintf('mysqldump --single-transaction --add-drop-table --host=%s --port=%d --user=%s --password=\'%s\' %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); } else if ($driver === 'pdo_pgsql') { return sprintf('PGPASSWORD=%s pg_dump --host=%s --port=%s --username=%s --dbname=%s --schema=public --no-owner --no-privileges', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); } From e05238aa5e6b41d60ebef59d65eebe6852f29639 Mon Sep 17 00:00:00 2001 From: Christian Schwahn Date: Wed, 4 Sep 2019 10:09:09 +0200 Subject: [PATCH 4/7] fix: false quoting --- .idea/Sitegeist.MagicWand.iml | 10 ----- .idea/misc.xml | 6 --- .idea/modules.xml | 8 ---- .idea/php.xml | 8 ---- .idea/vcs.xml | 6 --- .idea/workspace.xml | 79 ----------------------------------- 6 files changed, 117 deletions(-) delete mode 100644 .idea/Sitegeist.MagicWand.iml delete mode 100644 .idea/misc.xml delete mode 100644 .idea/modules.xml delete mode 100644 .idea/php.xml delete mode 100644 .idea/vcs.xml delete mode 100644 .idea/workspace.xml diff --git a/.idea/Sitegeist.MagicWand.iml b/.idea/Sitegeist.MagicWand.iml deleted file mode 100644 index 6d2b389..0000000 --- a/.idea/Sitegeist.MagicWand.iml +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - - - - - \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml deleted file mode 100644 index 28a804d..0000000 --- a/.idea/misc.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - - - \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml deleted file mode 100644 index 2b65113..0000000 --- a/.idea/modules.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - \ No newline at end of file diff --git a/.idea/php.xml b/.idea/php.xml deleted file mode 100644 index d5bc926..0000000 --- a/.idea/php.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml deleted file mode 100644 index 94a25f7..0000000 --- a/.idea/vcs.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/.idea/workspace.xml b/.idea/workspace.xml deleted file mode 100644 index 653c3b1..0000000 --- a/.idea/workspace.xml +++ /dev/null @@ -1,79 +0,0 @@ - - - - - - - - - $PROJECT_DIR$/composer.json - - - - - - - - - - - - - - - - - - - - - - - - - - 1567512488319 - - - - - - - - - \ No newline at end of file From 5c3ba33f05f952d92796b8da71bbeefe6fe61f77 Mon Sep 17 00:00:00 2001 From: Christian Schwahn Date: Wed, 11 Sep 2019 08:47:43 +0200 Subject: [PATCH 5/7] fix: buildCmb should have the same escaping for password --- Classes/DBAL/SimpleDBAL.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Classes/DBAL/SimpleDBAL.php b/Classes/DBAL/SimpleDBAL.php index c21fcb4..6ed95bc 100644 --- a/Classes/DBAL/SimpleDBAL.php +++ b/Classes/DBAL/SimpleDBAL.php @@ -22,7 +22,7 @@ class SimpleDBAL { public function buildCmd(string $driver, ?string $host, int $port, string $username, string $password, string $database): string { if ($driver === 'pdo_mysql') { - return sprintf('mysql --host=%s --port=%s --user=%s --password=%s %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); + return sprintf('mysql --host=%s --port=%s --user=%s --password=\'%s\' %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); } else if ($driver === 'pdo_pgsql') { return sprintf('PGOPTIONS=--client-min-messages=warning PGPASSWORD=%s psql --quiet --host=%s --port=%s --username=%s --dbname=%s', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); } From 310d73ecfa46dafb7129c6ef687757de11704499 Mon Sep 17 00:00:00 2001 From: Christian Schwahn Date: Wed, 11 Sep 2019 08:47:43 +0200 Subject: [PATCH 6/7] fix: buildCmb should have the same escaping for password --- Classes/DBAL/SimpleDBAL.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Classes/DBAL/SimpleDBAL.php b/Classes/DBAL/SimpleDBAL.php index c21fcb4..c138537 100644 --- a/Classes/DBAL/SimpleDBAL.php +++ b/Classes/DBAL/SimpleDBAL.php @@ -22,9 +22,9 @@ class SimpleDBAL { public function buildCmd(string $driver, ?string $host, int $port, string $username, string $password, string $database): string { if ($driver === 'pdo_mysql') { - return sprintf('mysql --host=%s --port=%s --user=%s --password=%s %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); + return sprintf('mysql --host=%s --port=%s --user=%s --password=\'%s\' %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); } else if ($driver === 'pdo_pgsql') { - return sprintf('PGOPTIONS=--client-min-messages=warning PGPASSWORD=%s psql --quiet --host=%s --port=%s --username=%s --dbname=%s', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); + return sprintf('PGOPTIONS=--client-min-messages=warning PGPASSWORD=\'%s\' psql --quiet --host=%s --port=%s --username=%s --dbname=%s', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); } } @@ -42,7 +42,7 @@ public function buildDumpCmd(string $driver, ?string $host, int $port, string $u if ($driver === 'pdo_mysql') { return sprintf('mysqldump --single-transaction --add-drop-table --host=%s --port=%d --user=%s --password=\'%s\' %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); } else if ($driver === 'pdo_pgsql') { - return sprintf('PGPASSWORD=%s pg_dump --host=%s --port=%s --username=%s --dbname=%s --schema=public --no-owner --no-privileges', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); + return sprintf('PGPASSWORD=\'%s\' pg_dump --host=%s --port=%s --username=%s --dbname=%s --schema=public --no-owner --no-privileges', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); } } From 2e2e3b069de5b87a33a7c775b639cca7a93c97f9 Mon Sep 17 00:00:00 2001 From: Martin Ficzel Date: Wed, 11 Sep 2019 10:48:07 +0200 Subject: [PATCH 7/7] TASK: Add more escaping for the password to support $, brachets and other strange characters that cause trouble ob a shell The full pattern is `--password=\'"\'"\'%s\'"\'"\'` but the inner quotes are added by escapeshellarg --- Classes/DBAL/SimpleDBAL.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Classes/DBAL/SimpleDBAL.php b/Classes/DBAL/SimpleDBAL.php index c138537..23cbbca 100644 --- a/Classes/DBAL/SimpleDBAL.php +++ b/Classes/DBAL/SimpleDBAL.php @@ -22,9 +22,9 @@ class SimpleDBAL { public function buildCmd(string $driver, ?string $host, int $port, string $username, string $password, string $database): string { if ($driver === 'pdo_mysql') { - return sprintf('mysql --host=%s --port=%s --user=%s --password=\'%s\' %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); + return sprintf('mysql --host=%s --port=%s --user=%s --password=\'"\'"%s"\'"\'', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); } else if ($driver === 'pdo_pgsql') { - return sprintf('PGOPTIONS=--client-min-messages=warning PGPASSWORD=\'%s\' psql --quiet --host=%s --port=%s --username=%s --dbname=%s', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); + return sprintf('PGOPTIONS=--client-min-messages=warning PGPASSWORD=\'"\'"%s"\'"\' psql --quiet --host=%s --port=%s --username=%s --dbname=%s', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); } } @@ -40,9 +40,9 @@ public function buildCmd(string $driver, ?string $host, int $port, string $usern public function buildDumpCmd(string $driver, ?string $host, int $port, string $username, string $password, string $database): string { if ($driver === 'pdo_mysql') { - return sprintf('mysqldump --single-transaction --add-drop-table --host=%s --port=%d --user=%s --password=\'%s\' %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); + return sprintf('mysqldump --single-transaction --add-drop-table --host=%s --port=%d --user=%s --password=\'"\'"%s"\'"\' %s', escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($password), escapeshellarg($database)); } else if ($driver === 'pdo_pgsql') { - return sprintf('PGPASSWORD=\'%s\' pg_dump --host=%s --port=%s --username=%s --dbname=%s --schema=public --no-owner --no-privileges', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); + return sprintf('PGPASSWORD=\'"\'"%s"\'"\' pg_dump --host=%s --port=%s --username=%s --dbname=%s --schema=public --no-owner --no-privileges', escapeshellarg($password), escapeshellarg($host), escapeshellarg($port), escapeshellarg($username), escapeshellarg($database)); } }