diff options
| author | Steve Bennett <steveb@workware.net.au> | 2017-05-05 13:04:24 +1000 |
|---|---|---|
| committer | Steve Bennett <steveb@workware.net.au> | 2025-07-16 09:34:08 +1000 |
| commit | dc4117996113d8fc379d0f4c46b078aa16e6ccf7 (patch) | |
| tree | 4b79c4cd1234cead4c7528e3b70331f8ff0387b9 | |
| parent | f72a03487ec28328678d48472026877e7d66bc29 (diff) | |
| download | jimtcl-dc4117996113d8fc379d0f4c46b078aa16e6ccf7.zip jimtcl-dc4117996113d8fc379d0f4c46b078aa16e6ccf7.tar.gz jimtcl-dc4117996113d8fc379d0f4c46b078aa16e6ccf7.tar.bz2 | |
jim-sqlite3: Add taint support
Signed-off-by: Steve Bennett <steveb@workware.net.au>
| -rw-r--r-- | jim-sqlite3.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/jim-sqlite3.c b/jim-sqlite3.c index 61d4c52..dbb3d4f 100644 --- a/jim-sqlite3.c +++ b/jim-sqlite3.c @@ -75,6 +75,11 @@ static Jim_Obj *JimSqliteFormatQuery(Jim_Interp *interp, Jim_Obj *fmtObjPtr, int fmtLen; Jim_Obj *resObjPtr; + if (Jim_GetObjTaint(fmtObjPtr) & JIM_TAINT_ANY) { + Jim_SetResultString(interp, "sqlite3 query: tainted data", -1); + return NULL; + } + fmt = Jim_GetString(fmtObjPtr, &fmtLen); resObjPtr = Jim_NewStringObj(interp, "", 0); while (fmtLen) { @@ -269,6 +274,12 @@ static int JimSqliteOpenCommand(Jim_Interp *interp, int argc, Jim_Obj *const *ar Jim_WrongNumArgs(interp, 1, argv, "dbname"); return JIM_ERR; } + + if (Jim_CheckTaint(interp, JIM_TAINT_ANY)) { + Jim_SetTaintError(interp, 1, argv); + return JIM_ERR; + } + r = sqlite3_open(Jim_String(argv[1]), &db); if (r != SQLITE_OK) { Jim_SetResultString(interp, sqlite3_errmsg(db), -1); |