Merge branch 'sql'

1 files changed, 139 insertions, 70 deletions

diff --git a/execute.c b/execute.c
index 1f7cf15..82a4866 100644
--- a/execute.c
+++ b/execute.c
@@ -24,6 +24,7 @@
 #endif
 
 #include <fcntl.h>
+#include <fnmatch.h>
 #include "php.h"
 #include "php_ini.h"
 #include "zend_hash.h"
@@ -880,7 +881,7 @@ int ih_querycheck(IH_HANDLER_PARAMS)
                 return (0);
         }
     
-        if ((long) ih->arg1) {
+        if ((long) ih->arg2) {
             mysql_extension = 1;
         }
         
@@ -892,6 +893,7 @@ int ih_querycheck(IH_HANDLER_PARAMS)
         }
         len = Z_STRLEN_P(backup);
         query = Z_STRVAL_P(backup);
+        SDEBUG("SQL |%s|", query);
         
         s = query;
         e = s+len;
@@ -1023,29 +1025,16 @@ int ih_fixusername(IH_HANDLER_PARAMS)
         void **p = EG(argument_stack).top_element-2;
 #endif
         unsigned long arg_count;
-        zval **arg;char *prefix, *postfix, *user;
+        zval **arg;
+        char *prefix, *postfix, *user, *user_match, *cp;
         zval *backup, *my_user;
         int prefix_len, postfix_len, len;
         
-        SDEBUG("function: %s", ih->name);
+        SDEBUG("function (fixusername): %s", ih->name);
         
         prefix = SUHOSIN_G(sql_user_prefix);
         postfix = SUHOSIN_G(sql_user_postfix);
-        
-        if ((prefix == NULL || prefix[0] == 0)&& 
-                (postfix == NULL || postfix[0] == 0)) {
-                return (0);
-        }
-        
-        if (prefix == NULL) {
-                prefix = "";
-        }
-        if (postfix == NULL) {
-                postfix = "";
-        }
-        
-        prefix_len = strlen(prefix);
-        postfix_len = strlen(postfix);
+        user_match = SUHOSIN_G(sql_user_match);
         
         arg_count = (unsigned long) *p;
 
@@ -1064,26 +1053,60 @@ int ih_fixusername(IH_HANDLER_PARAMS)
                 user = Z_STRVAL_P(backup);
         }
 
-        if (prefix_len && prefix_len <= len) {
-                if (strncmp(prefix, user, prefix_len)==0) {
-                        prefix = "";
-                        len -= prefix_len;
+        cp = user;
+        while (cp < user+len) {
+                if (*cp < 32) {
+                        suhosin_log(S_SQL, "SQL username contains invalid characters");
+                        if (!SUHOSIN_G(simulation)) {
+                                RETVAL_FALSE;
+                                return (1);
+                        } else {
+                                break;
+                        }
                 }
+                cp++;
         }
-        
-        if (postfix_len && postfix_len <= len) {
-                if (strncmp(postfix, user+len-postfix_len, postfix_len)==0) {
+
+        if ((prefix != NULL && prefix[0]) || (postfix != NULL && postfix[0])) {
+                if (prefix == NULL) {
+                        prefix = "";
+                }
+                if (postfix == NULL) {
                         postfix = "";
                 }
+                prefix_len = strlen(prefix);
+                postfix_len = strlen(postfix);
+                
+                MAKE_STD_ZVAL(my_user);
+                my_user->type = IS_STRING;
+                my_user->value.str.len = spprintf(&my_user->value.str.val, 0, "%s%s%s", prefix, user, postfix);
+        
+                /* XXX: memory_leak? */
+                *arg = my_user; 
+                
+                len = Z_STRLEN_P(my_user);
+                user = Z_STRVAL_P(my_user);
         }
         
-        MAKE_STD_ZVAL(my_user);
-        my_user->type = IS_STRING;
-        my_user->value.str.len = spprintf(&my_user->value.str.val, 0, "%s%s%s", prefix, user, postfix);
+        if (user_match && user_match[0]) {
+#ifdef HAVE_FNMATCH
+                if (fnmatch(user_match, user, 0) != 0) {
+                        suhosin_log(S_SQL, "SQL username ('%s') does not match suhosin.sql.user_match ('%s')", user, user_match);
+                        if (!SUHOSIN_G(simulation)) {
+                                RETVAL_FALSE;
+                                return (1);
+                        }
+                }
+#else
+#warning no support for fnmatch() - setting suhosin.sql.user_match will always fail.
+                suhosin_log(S_SQL, "suhosin.sql.user_match specified, but system does not support fnmatch()");
+                if (!SUHOSIN_G(simulation)) {
+                        RETVAL_FALSE;
+                        return (1);
+                }
+#endif
+        }
         
-        /* XXX: memory_leak? */
-        *arg = my_user; 
-         
         SDEBUG("function: %s - user: %s", ih->name, user);
 
         return (0);
@@ -1552,9 +1575,9 @@ static int ih_getrandmax(IH_HANDLER_PARAMS)
 }
 
 internal_function_handler ihandlers[] = {
-    { "preg_replace", ih_preg_replace, NULL, NULL, NULL },
-    { "mail", ih_mail, NULL, NULL, NULL },
-    { "symlink", ih_symlink, NULL, NULL, NULL },
+        { "preg_replace", ih_preg_replace, NULL, NULL, NULL },
+        { "mail", ih_mail, NULL, NULL, NULL },
+        { "symlink", ih_symlink, NULL, NULL, NULL },
         
         { "srand", ih_srand, NULL, NULL, NULL },
         { "mt_srand", ih_mt_srand, NULL, NULL, NULL },
@@ -1563,49 +1586,95 @@ internal_function_handler ihandlers[] = {
         { "getrandmax", ih_getrandmax, NULL, NULL, NULL },
         { "mt_getrandmax", ih_getrandmax, NULL, NULL, NULL },
         
-    { "ocilogon", ih_fixusername, (void *)1, NULL, NULL },
-    { "ociplogon", ih_fixusername, (void *)1, NULL, NULL },
-    { "ocinlogon", ih_fixusername, (void *)1, NULL, NULL },
-    { "oci_connect", ih_fixusername, (void *)1, NULL, NULL },
-    { "oci_pconnect", ih_fixusername, (void *)1, NULL, NULL },
-    { "oci_new_connect", ih_fixusername, (void *)1, NULL, NULL },
+        { "function_exists", ih_function_exists, NULL, NULL, NULL },
         
-    { "fbsql_change_user", ih_fixusername, (void *)1, NULL, NULL },
-    { "fbsql_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "fbsql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
-    
-    { "function_exists", ih_function_exists, NULL, NULL, NULL },
+        /* Mysqli */
+        { "mysqli::mysqli", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysqli_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysqli::real_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysqli_real_connect", ih_fixusername, (void *)3, NULL, NULL },
+        { "mysqli_change_user", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysqli::change_user", ih_fixusername, (void *)1, NULL, NULL },
+        
+        { "mysqli::query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli::multi_query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_multi_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli::prepare", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_prepare", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli::real_query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_real_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli::send_query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysqli_send_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        // removed in PHP 5.3
+        { "mysqli_master_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysqli_slave_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        // ----
         
-    { "ifx_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "ifx_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        /* Mysql API - deprecated in PHP 5.5 */
+        { "mysql_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mysql_query", ih_querycheck, (void *)1, (void *)1, NULL },
+        { "mysql_db_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        { "mysql_unbuffered_query", ih_querycheck, (void *)1, (void *)1, NULL },
+        
+#ifdef SUHOSIN_EXPERIMENTAL
+        /* MaxDB */
+        { "maxdb::maxdb", ih_fixusername, (void *)2, NULL, NULL },
+        { "maxdb_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "maxdb::real_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "maxdb_real_connect", ih_fixusername, (void *)3, NULL, NULL },
+        { "maxdb::change_user", ih_fixusername, (void *)1, NULL, NULL },
+        { "maxdb_change_user", ih_fixusername, (void *)2, NULL, NULL },
+        
+        { "maxdb_master_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::multi_query", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_multi_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::query", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::real_query", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_real_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::send_query", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_send_query", ih_querycheck, (void *)2, NULL, NULL },
+        { "maxdb::prepare", ih_querycheck, (void *)1, NULL, NULL },
+        { "maxdb_prepare", ih_querycheck, (void *)2, NULL, NULL },
 
-    { "ibase_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "ibase_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        /* PDO */
+                /* note: mysql conditional comments not supported here */
+        { "pdo::__construct", ih_fixusername, (void *)2, NULL, NULL }, /* note: username may come from dsn (param 1) */
+        { "pdo::query", ih_querycheck, (void *)1, NULL, NULL },
+        { "pdo::prepare", ih_querycheck, (void *)1, NULL, NULL },
+        { "pdo::exec", ih_querycheck, (void *)1, NULL, NULL },
+        
+        /* Oracle OCI8 */
+        { "ocilogon", ih_fixusername, (void *)1, NULL, NULL },
+        { "ociplogon", ih_fixusername, (void *)1, NULL, NULL },
+        { "ocinlogon", ih_fixusername, (void *)1, NULL, NULL },
+        { "oci_connect", ih_fixusername, (void *)1, NULL, NULL },
+        { "oci_pconnect", ih_fixusername, (void *)1, NULL, NULL },
+        { "oci_new_connect", ih_fixusername, (void *)1, NULL, NULL },
 
-    { "maxdb", ih_fixusername, (void *)2, NULL, NULL },
-    { "maxdb_change_user", ih_fixusername, (void *)2, NULL, NULL },
-    { "maxdb_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "maxdb_pconnect", ih_fixusername, (void *)2, NULL, NULL },
-    { "maxdb_real_connect", ih_fixusername, (void *)3, NULL, NULL },
+        /* FrontBase */
+        { "fbsql_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "fbsql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        { "fbsql_change_user", ih_fixusername, (void *)1, NULL, NULL },
+        { "fbsql_username", ih_fixusername, (void *)2, NULL, NULL },
 
-    { "mssql_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "mssql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        /* Informix */
+        { "ifx_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "ifx_pconnect", ih_fixusername, (void *)2, NULL, NULL },
 
-    { "mysql_query", ih_querycheck, (void *)1, (void *)1, NULL },
-    { "mysql_db_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysql_unbuffered_query", ih_querycheck, (void *)1, (void *)1, NULL },
-    { "mysqli_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysqli_real_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysqli_send_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysqli_master_query", ih_querycheck, (void *)2, (void *)1, NULL },
-    { "mysqli_slave_query", ih_querycheck, (void *)2, (void *)1, NULL },
+        /* Firebird/InterBase */
+        { "ibase_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "ibase_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+        { "ibase_service_attach", ih_fixusername, (void *)2, NULL, NULL },
+
+        /* Microsoft SQL Server */
+        { "mssql_connect", ih_fixusername, (void *)2, NULL, NULL },
+        { "mssql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
+#endif
 
-    { "mysqli", ih_fixusername, (void *)2, NULL, NULL },
-    { "mysql_connect", ih_fixusername, (void *)2, NULL, NULL },
-    { "mysql_pconnect", ih_fixusername, (void *)2, NULL, NULL },
-    { "mysqli_change_user", ih_fixusername, (void *)2, NULL, NULL },
-    { "mysql_real_connect", ih_fixusername, (void *)3, NULL, NULL },
-    { NULL, NULL, NULL, NULL, NULL }
+        { NULL, NULL, NULL, NULL, NULL }
 };
 
 #define FUNCTION_WARNING() zend_error(E_WARNING, "%s() has been disabled for security reasons", get_active_function_name(TSRMLS_C));