MindMap macro has a SQL injection

[Jun Omae]

If a single quote character is used in content in MindMap macro, the following error is raised.

...
  File "/home/jun66j5/src/trac/trac-hacks/mindmapmacro/0.11/tracmindmap/macro.py", line 205, in expand_macro
    self._set_cache(hash, mm)
  File "/home/jun66j5/src/trac/trac-hacks/mindmapmacro/0.11/tracmindmap/macro.py", line 152, in _set_cache
    cursor.execute("INSERT INTO mindmapcache VALUES ('%s','%s')" % (hash,content) )
  File "/home/jun66j5/venv/trac/1.0.1/lib/python2.5/site-packages/trac/db/util.py", line 66, in execute
    return self.cursor.execute(sql)
  File "/home/jun66j5/venv/trac/1.0.1/lib/python2.5/site-packages/trac/db/sqlite_backend.py", line 78, in execute
    result = PyFormatCursor.execute(self, *args)
  File "/home/jun66j5/venv/trac/1.0.1/lib/python2.5/site-packages/trac/db/sqlite_backend.py", line 56, in execute
    args or [])
  File "/home/jun66j5/venv/trac/1.0.1/lib/python2.5/site-packages/trac/db/sqlite_backend.py", line 48, in _rollback_on_error
    return function(self, *args, **kwargs)
OperationalError: unrecognized token: ""/></node></node></map>')"

mindmapmacro/0.11/tracmindmap/macro.py

@@ -146 +146 @@
     def _set_cache(self, hash, content):
         db = self.env.get_db_cnx()
         cursor = db.cursor()
-        cursor.execute("INSERT INTO mindmapcache VALUES ('%s','%s')" % (hash,content) )
+        cursor.execute("INSERT INTO mindmapcache VALUES (%s,%s)",
+                       (hash, unicode(content)))
         db.commit()
 
     def _get_cache(self, hash, default=None):

[Ryan J Ollos]

I tried to get in touch with the author in #7481, but it seems like he is not longer around. It looks like this is another case where we should just go ahead and push the change if we don't hear from him within a few days.

[Martin Scharrer]

Hi guys, sorry I'm very busy with my day job and don't read all emails I get. Feel free to push that change. I'm not sure if I find time to do it myself in the next time.

[Jun Omae]

In 14043:

Use the Trac DB-API to prevent SQL injection (fixed #11829)

[Jun Omae]

Thanks for the response. I've commited the changes.