diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2023-02-13 13:56:10 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2023-02-16 10:25:39 +0100 |
| commit | f7153594f028c09f9510141ee532ed30982f3112 (patch) | |
| tree | c67e028d3edccdbbc49f4677409a6d3a3cc024f3 | |
| parent | d3aca6535793a3621bb1983e5bc754076a25ace1 (diff) | |
disable script dump
Change-Id: I04d740cc0fcf87daa192a0a6af34138278043a19
| -rw-r--r-- | connectivity/source/drivers/hsqldb/HDriver.cxx | 31 | ||||
| -rw-r--r-- | external/hsqldb/UnpackedTarball_hsqldb.mk | 1 | ||||
| -rw-r--r-- | external/hsqldb/patches/disable-dump-script.patch | 36 |
3 files changed, 68 insertions, 0 deletions
diff --git a/connectivity/source/drivers/hsqldb/HDriver.cxx b/connectivity/source/drivers/hsqldb/HDriver.cxx index 962e574879cf..5ef40fbd6914 100644 --- a/connectivity/source/drivers/hsqldb/HDriver.cxx +++ b/connectivity/source/drivers/hsqldb/HDriver.cxx @@ -290,6 +290,37 @@ namespace connectivity } // if ( xStream.is() ) ::comphelper::disposeComponent(xStream); } + + // disallow any database/script files that contain a "SCRIPT[.*]" entry (this is belt and braces + // in that bundled hsqldb 1.8.0 is patched to also reject them) + // + // hsqldb 2.6.0 release notes have: added system role SCRIPT_OPS for export / import of database structure and data + // which seems to provide a builtin way to do this with contemporary hsqldb + static const OUStringLiteral sScript(u"script"); + if (!bIsNewDatabase && xStorage->isStreamElement(sScript)) + { + Reference<XStream > xStream = xStorage->openStreamElement(sScript, ElementModes::READ); + if (xStream.is()) + { + std::unique_ptr<SvStream> pStream(::utl::UcbStreamHelper::CreateStream(xStream)); + if (pStream) + { + OStringBuffer sLine; + while (pStream->ReadLine(sLine)) + { + OString sText = sLine.makeStringAndClear().trim(); + if (sText.startsWithIgnoreAsciiCase("SCRIPT")) + { + ::connectivity::SharedResources aResources; + sMessage = aResources.getResourceString(STR_COULD_NOT_LOAD_FILE).replaceFirst("$filename$", sSystemPath); + break; + } + } + } + } // if ( xStream.is() ) + ::comphelper::disposeComponent(xStream); + } + } catch(Exception&) { diff --git a/external/hsqldb/UnpackedTarball_hsqldb.mk b/external/hsqldb/UnpackedTarball_hsqldb.mk index cbba770f19a0..ed262cccf4ca 100644 --- a/external/hsqldb/UnpackedTarball_hsqldb.mk +++ b/external/hsqldb/UnpackedTarball_hsqldb.mk @@ -29,6 +29,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,hsqldb,\ external/hsqldb/patches/jdbc-4.1.patch \ external/hsqldb/patches/multipleResultSets.patch \ ) \ + external/hsqldb/patches/disable-dump-script.patch \ )) # vim: set noet sw=4 ts=4: diff --git a/external/hsqldb/patches/disable-dump-script.patch b/external/hsqldb/patches/disable-dump-script.patch new file mode 100644 index 000000000000..13e0213f7e57 --- /dev/null +++ b/external/hsqldb/patches/disable-dump-script.patch @@ -0,0 +1,36 @@ +--- a/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java 2023-02-13 11:08:11.297243034 +0000 ++++ b/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java 2023-02-13 13:49:17.973089433 +0000 +@@ -392,31 +392,19 @@ + */ + private Result processScript() throws IOException, HsqlException { + +- String token = tokenizer.getString(); +- ScriptWriterText dsw = null; ++ tokenizer.getString(); + + session.checkAdmin(); + + try { + if (tokenizer.wasValue()) { +- if (tokenizer.getType() != Types.VARCHAR) { +- throw Trace.error(Trace.INVALID_IDENTIFIER); +- } +- +- dsw = new ScriptWriterText(database, token, true, true, true); +- +- dsw.writeAll(); +- +- return new Result(ResultConstants.UPDATECOUNT); ++ throw Trace.error(Trace.ACCESS_IS_DENIED); + } else { + tokenizer.back(); + + return DatabaseScript.getScript(database, false); + } + } finally { +- if (dsw != null) { +- dsw.close(); +- } + } + } + |