Attachment #169343 for bug #37018

View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All




            my $path   = $req->url->to_abs->path;
            my $type = "";

            if ( blessed $exception && ref($exception) eq 'Koha::Exceptions::REST::Query::InvalidOperator' ) {
                return $c->render(
                    status => 500,
                    json   => {
                        error      => printf( "Invalid operator in query: %s", $exception->operator ),
                        error_code => 'invalid_query',
                    }
                );
            }

            if ( blessed $exception ) {
                $type = "(" . ref($exception) . ")";
            }

Lines 171-177 subtest 'SQL injection in "query" handling' => sub { Link Here

(-)a/t/db_dependent/api/v1/query.t (-2 / +1 lines)
171	"[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";	171	"[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
172		172
173	$t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")	173	$t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
174	->status_is( 400, 'Attempt to inject SQL through operators is rejected' );	174	->status_is( 500, 'Attempt to inject SQL through operators is rejected' );
175		175
176	$schema->storage->txn_rollback;	176	$schema->storage->txn_rollback;
177	};	177	};
178	-

Return to bug 37018

Lines 59-64 sub register { Link Here

(-)a/Koha/REST/Plugin/Exceptions.pm (+10 lines)
59	my $path = $req->url->to_abs->path;	59	my $path = $req->url->to_abs->path;
60	my $type = "";	60	my $type = "";
61		61
		62	if ( blessed $exception && ref($exception) eq 'Koha::Exceptions::REST::Query::InvalidOperator' ) {
		63	return $c->render(
		64	status => 500,
		65	json => {
		66	error => printf( "Invalid operator in query: %s", $exception->operator ),
		67	error_code => 'invalid_query',
		68	}
		69	);
		70	}
		71
62	if ( blessed $exception ) {	72	if ( blessed $exception ) {
63	$type = "(" . ref($exception) . ")";	73	$type = "(" . ref($exception) . ")";
64	}	74	}