Skip to content

Handle SQL injection vulnerabilities within ObjectToSQLString #3547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 26 commits into from
Jul 2, 2024
Merged

Handle SQL injection vulnerabilities within ObjectToSQLString #3547

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
d4b9daf
Add injection test cases
fredericDelaporte May 14, 2024
a3619ac
Add a discriminator injection test
fredericDelaporte Jun 9, 2024
b7a153a
Add a test for special characters
fredericDelaporte May 19, 2024
d2ff013
Minor code cleanup
hazzik Jun 3, 2024
d480863
Add test for char
fredericDelaporte May 26, 2024
61a9549
Minor code cleanup
hazzik Jun 3, 2024
897a869
Initial is reserved keyword in oracle
hazzik Jun 3, 2024
f6c3988
Add a charenum injection test
fredericDelaporte Jun 9, 2024
d7677c6
Add an Uri injection test case
fredericDelaporte Jun 9, 2024
69c4c12
Add numerical types injection test cases
fredericDelaporte Jun 9, 2024
d85c5a6
Add a datetime test case
fredericDelaporte Jun 10, 2024
4cf9fd3
Escapes string in AbstractStringType
fredericDelaporte May 12, 2024
2d21ff3
Fix argument name
hazzik Jun 3, 2024
0dcbfca
Fix a test failing due to new Unicode support
fredericDelaporte May 13, 2024
2da9e9e
Fix the char type
fredericDelaporte May 26, 2024
02bcc42
Fix types handled as SQL strings
fredericDelaporte Jun 9, 2024
edc4177
Add a minimal fix for numeric types
fredericDelaporte Jun 9, 2024
77fe3e5
Minimal fix for the datetime case
fredericDelaporte Jun 10, 2024
aa91eb7
Disallow culture injection for numeric types
fredericDelaporte Jun 11, 2024
03936a2
Disallow culture injecton in ticks dependent types
fredericDelaporte Jun 11, 2024
b7c0576
Generate async files
github-actions[bot] Jun 11, 2024
ea888be
Switch to cast instead of convert
fredericDelaporte Jun 12, 2024
27bc4bf
Add injection test for other datetime types
fredericDelaporte Jun 12, 2024
0c35063
Fix other datetime types
fredericDelaporte Jun 12, 2024
e80b766
Add a Guid injection test
fredericDelaporte Jun 12, 2024
a1cebb2
Fix the Guid type
fredericDelaporte Jun 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions doc/reference/modules/configuration.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -871,6 +871,20 @@ var session = sessions.OpenSession(conn);
</para>
</entry>
</row>
<row>
<entry>
<literal>escape_backslash_in_strings</literal>
</entry>
<entry>
Indicates if the database needs to have backslash escaped in string literals.
The default value is dialect dependant. That is <literal>false</literal> for
most dialects.
<para>
<emphasis role="strong">eg.</emphasis>
<literal>true</literal> | <literal>false</literal>
</para>
</entry>
</row>
<row>
<entry>
<literal>show_sql</literal>
Expand Down Expand Up @@ -1515,12 +1529,6 @@ in the parameter binding.</programlisting>
<entry><literal>NHibernate.Dialect.PostgreSQLDialect</literal></entry>
<entry></entry>
</row>
<row>
<entry>PostgreSQL</entry>
<entry><literal>NHibernate.Dialect.PostgreSQLDialect</literal></entry>
<entry>
</entry>
</row>
<row>
<entry>PostgreSQL 8.1</entry>
<entry><literal>NHibernate.Dialect.PostgreSQL81Dialect</literal></entry>
Expand Down
2 changes: 1 addition & 1 deletion src/NHibernate.Config.Templates/SapSQLAnywhere.cfg.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ for your own use before compiling tests in Visual Studio.
<property name="connection.connection_string">
UID=DBA;PWD=sql;Server=localhost;DBN=nhibernate;DBF=c:\nhibernate.db;ASTOP=No;Enlist=false;
</property>
<property name="dialect">NHibernate.Dialect.SybaseSQLAnywhere12Dialect</property>
<property name="dialect">NHibernate.Dialect.SapSQLAnywhere17Dialect</property>
<property name="query.substitutions">true=1;false=0</property>
</session-factory>
</hibernate-configuration>
Loading
Loading