Escape tokenize argument in enable_fts to prevent SQL injection - #828
Open
bunlongheng wants to merge 1 commit into
Open
Escape tokenize argument in enable_fts to prevent SQL injection#828bunlongheng wants to merge 1 commit into
bunlongheng wants to merge 1 commit into
Conversation
The tokenize value passed to Table.enable_fts() was interpolated directly into the CREATE VIRTUAL TABLE statement inside a single-quoted string literal. A value containing a single quote could break out of that literal and inject arbitrary SQL, which executes via executescript(). This is reachable from the CLI via 'enable-fts --tokenize'. Route the value through the existing Database.quote() helper so SQLite itself escapes it. Legitimate tokenizers such as 'porter' are unaffected. Adds a regression test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Table.enable_fts(tokenize=...)interpolated thetokenizevalue directly into theCREATE VIRTUAL TABLEstatement inside a single-quoted string literal:Because the statement runs through
executescript(), atokenizevalue containing a single quote can close the literal and append additional statements. This is reachable from the CLI viasqlite-utils enable-fts ... --tokenize.Fix
Route the value through the existing
Database.quote()helper, which uses SQLite's ownquote()to escape the string. Legitimate tokenizers such asporter(and multi-word forms likeporter unicode61) are unaffected, for both FTS4 and FTS5.Test
Added
test_fts_tokenize_escaped, which confirms a craftedtokenizevalue cannot create an extra table. Existing tokenize tests (test_fts_tokenize) still pass.📚 Documentation preview 📚: https://sqlite-utils--828.org.readthedocs.build/en/828/