TheRON/core
1
0
Fork 0
mirror of https://framagit.org/hubzilla/core.git synced 2026-06-21 00:52:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

Escape args in xchan_fetch

Browse Source
This commit is contained in:
Harald Eilertsen
2026-01-04 14:55:03 +01:00
parent b6a58fbf6e
commit cedc6c4230
2 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/xchan.php
View File

@@ -166,7 +166,7 @@ function xchan_fetch($arr) {
if(! $key)
return false;
$r = q("select * from xchan where $key = '$v' limit 1");
$r = q("select * from xchan where $key = '%s' limit 1", dbesc($v));
if(! $r)
return false;

34
tests/unit/includes/XchanTest.php Normal file
View File

@@ -0,0 +1,34 @@
<?php
/*
* SPDX-FileCopyrightText: 2026 The Hubzilla Community
* SPDX-FileContributor: Harald Eilertsen <haraldei@anduin.net>
*
* SPDX-License-Identifier: MIT
*/
namespace Zotlabs\Tests\Unit;
use Zotlabs\Lib\Libzot;
class XChanTest extends UnitTestCase {
public function testXChanFetchShouldRejectInvalidArgs(): void {
$addr = 'example';
$guid = Libzot::new_uid($addr);
$hash = Libzot::make_xchan_hash($guid, 'dummy-public-key');
xchan_store_lowlevel([
'xchan_hash' => $hash,
'xchan_guid' => $guid,
'xchan_addr' => $addr,
]);
// Trivial SQL Injection
$this->assertFalse(xchan_fetch(['hash' => "{$hash}' or 1=1; -- "]));
$this->assertFalse(xchan_fetch(['guid' => "{$guid}' or 1=1; -- "]));
$this->assertFalse(xchan_fetch(['address' => "{$addr}' or 1=1; -- "]));
// Not a valid key
$this->assertFalse(xchan_fetch(['wrongkey' => $hash]));
}
}