Modify

Opened 2 years ago

Last modified 9 months ago

#9981 assigned defect

[PATCH] SQL injection vulnerability patch for TracDownloads

Reported by: aleksihanninen Owned by: rjollos
Priority: normal Component: DownloadsPlugin
Severity: normal Keywords:
Cc: Trac Release: 0.12

Description

There is a SQL injection vulnerability in the Trac Downloads plugin.

Two patches are provided as attached:

  1. tracdownloads_sql_injection_vulnerability.patch
  1. tracdownloads_patch_complete.patch

Use the first "sql injection vulnerability" patch to fix the vulnerability. The patch also introduces fix in the download link resolver (link generation for download files in wiki context) by file.

A more complete, but unfortunately largely untested, "complete" patch contains the first "sql injection vulnerability" patch and also introduces other fixes, like:

  • Editing just the description of the downloads won't crash. (If editing just the description of the downloads, you shouldn't expect any file to be uploaded)
  • Since components should not use self.*, add a dict req_data and use that instead. This improves the security of concurrency.

Unfortunately, I haven't been able to test this with Vanilla trac, and I give no guarantees whatsoever. However, the first patch should work without problems.

My environment consists of Apache, Linux, Python 2.6, and Trac 0.12.1.

Attachments (2)

tracdownloads_sql_injection_vulnerability.patch (5.7 KB) - added by aleksihanninen 2 years ago.
tracdownloads_patch_complete.patch (30.8 KB) - added by aleksihanninen 2 years ago.

Download all attachments as: .zip

Change History (4)

Changed 2 years ago by aleksihanninen

Changed 2 years ago by aleksihanninen

comment:1 Changed 2 years ago by aleksihanninen

I also changed import * to more specific versions and fixed some CSRF vulnerabilities in the "complete" patch.

comment:2 Changed 9 months ago by rjollos

  • Owner changed from Blackhex to rjollos
  • Status changed from new to assigned

Add Comment

Modify Ticket

Action
as assigned .
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.