Conversation
order_field_text interpolated order_field and order_sort straight into a raw ORDER BY fragment, so any caller of the space file listing endpoints could inject SQL through them. Accept only the four sort keys the API contract exposes and reject anything else, and constrain both query parameters to those values.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
SpaceFileDao.order_field_textbuilds the ORDER BY fragment by interpolating itstwo arguments into a string (
knowledge_space_file.py:283), and the result ishanded to
text()atknowledge_space_file.py:234and:239and atknowledge_file.py:557. Both arguments arrive from the query string ofGET /api/v1/knowledge/space/{space_id}/childrenandGET /api/v1/knowledge/space/{space_id}/search(knowledge_space.py:345and:382), where they are typed as a plainstrwith no further checking.Why
text()takes the fragment verbatim, so whatever the caller sends becomes partof the statement. There is no allow list and no escaping anywhere on the path.
The neighbouring branches in the same function already show the intended
shape:
knowledge_file.py:559and:561order by a fixed column referencepicked by an
elifover known values, which cannot carry caller input.How
order_field_textnow rejects anything outside the four sort keys the APIcontract exposes, and rejects a direction other than asc or desc. The values
are the ones the web client sends (
SortTypeinapi/knowledge.ts:69), so noexisting caller changes behaviour. The two endpoints also declare the
parameters as
Literal, which turns a bad value into a 422 instead of a 500.The
file_typebranch keeps its CASE expression, which is built from aconstant table. It interpolates
order_sorttwice(
knowledge_space_file.py:276and:280), so the direction check appliesthere as well.
Test
pytest test/knowledge/test_order_field_allow_list.pycovers each supportedsort key and rejects six malformed field values and five malformed directions.
Against the unpatched function those eleven cases fail and the eight
legitimate ones pass. The wider backend suite was not run here, it needs a
configured Milvus, Elasticsearch and MinIO.
Related
References
GHSA-hhmh-3fj8-f53v (reported privately, unpublished at time of writing)
Found during a penetration test by turingpoint.