vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: use stricter regex for sanitize_searchfield

Browse source
This commit is contained in:
Daizy Modi 2022-12-14 16:05:56 +05:30
parent 1fc2639123
commit 4d9be26ada
1 changed files with 4 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
frappe/desk/search.py
View file

@ -7,45 +7,18 @@ import re
import frappe
from frappe import _, is_whitelisted
from frappe.database.schema import SPECIAL_CHAR_PATTERN
from frappe.permissions import has_permission
from frappe.utils import cint, cstr, unique
def sanitize_searchfield(searchfield):
blacklisted_keywords = ["select", "delete", "drop", "update", "case", "and", "or", "like"]
if not searchfield:
return
def _raise_exception(searchfield):
if SPECIAL_CHAR_PATTERN.search(searchfield):
frappe.throw(_("Invalid Search Field {0}").format(searchfield), frappe.DataError)
if len(searchfield) == 1:
# do not allow special characters to pass as searchfields
regex = re.compile(r'^.*[=;*,\'"$\-+%#@()_].*')
if regex.match(searchfield):
_raise_exception(searchfield)
if len(searchfield) >= 3:
# to avoid 1=1
if "=" in searchfield:
_raise_exception(searchfield)
# in mysql -- is used for commenting the query
elif " --" in searchfield:
_raise_exception(searchfield)
# to avoid and, or and like
elif any(f" {keyword} " in searchfield.split() for keyword in blacklisted_keywords):
_raise_exception(searchfield)
# to avoid select, delete, drop, update and case
elif any(keyword in searchfield.split() for keyword in blacklisted_keywords):
_raise_exception(searchfield)
else:
regex = re.compile(r'^.*[=;*,\'"$\-+%#@()].*')
if any(regex.match(f) for f in searchfield.split()):
_raise_exception(searchfield)
# this is called by the Link Field
@frappe.whitelist()