<div dir="ltr">I fully support this change <br><br>anyone relying on this functionality can easily write some wrapper code in php <br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jun 18, 2013 at 12:12 AM, Andrew DeMerchant <span dir="ltr"><<a href="mailto:andrew.demerchant@gemtec.ca" target="_blank">andrew.demerchant@gemtec.ca</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><u></u>
<div bgcolor="#ffffff" text="#000000">
Good points, for sure. The MGOS 2.0 docs <a href="http://www.osgeo.org/files/mapguide/docs/2.0/d5/d10/class_mg_feature_service_6b09a6f5e5ae73065e3d6d24110f7d81.htm" target="_blank">here</a>
seem to say that it used to only handle SELECT queries, and that
anything else would return MgFdoException....either that got changed
at some point after v2.0 or that statement was wrong. If it got
changed, maybe it's just a matter of looking how it was handled in
that older version? You might be able to revert and take some ideas
from there....if that statement was just plain wrong though, you
might be right - getting rid of it might be easiest.<br>
<br>
When I'd made my comments, I was thinking of a very basic sql
grammer parser, yes. Even just something as simple as making sure
the statement starts with "select" and doesn't have any commands
that you'd like to block. <br>
<br>
Personally, I don't use ExecuteSqlQuery, so I'm not going to be
affected! And maybe no one's really using it...maybe it's no big
deal to get rid of it. My suggestion was just the first thing to
come to mind after reading that rfc. <br><div><div class="h5">
<br>
<br>
<br>
On 13/06/17 10:52 AM, Jackie Ng wrote:
<blockquote type="cite">
<pre>In hindsight I probably should've had hotfixes on hand first before making
this announcement.
Nevertheless, if you want to patch this vulnerability out first and discuss
later, I've added hotfix dlls for MGOS 2.2, MGOS 2.4, MGOS 2.5 to the RFC
page. Simply overwrite the MgHttpHandler.dll under your <MapGuide
Install>\Web\Php and <MapGuide Install>\Web\www\mapagent directories
Once you've applied this hotfix and restarted your web server, your MapGuide
installation will no longer support the EXECUTESQLQUERY operation in the
mapagent, plugging up this particular vulnerability.
Linux users can apply the given patch and compile a new libMgHttpHandler.so.
I'm somewhat strained on Linux build resources, so if others can chip in and
provide patched libMgHttpHandler.so files for the various versions of MGOS,
that would be great.
Now to actually respond to your post. I mention the lack of SQL safeguards,
but I don't think implementing such safeguards is going to be that "simple".
How do we:
a) Guard against SQL injection (EXECUTESQLQUERY doesn't use bind
parameters)?
b) Prevent joining against tables that aren't meant or supposed to be
joined?
c) Protect against un-authorized SQL execution from session-based copies of
a Feature Source?
d) Most importantly, do all of this in C++?
Do we have to implement our own SQL grammar parser? How do we handle the
various DBMS-specific dialects?
There's a lot of unknowns and lots of risks involved. And for what? To
execute SQL over the internet via HTTP? That sentence alone smells of
security holes waiting to be punched wide open!
This RFCs says to take the easiest path: gut this feature out until we can
rethink how to do this in a safe manner if that's even possible! I currently
think it's not. Especially not over a public-facing component like the
mapagent.
- Jackie
--
View this message in context: <a href="http://osgeo-org.1560.x6.nabble.com/IMPORTANT-MapGuide-RFC-136-is-ready-for-review-tp5060534p5060600.html" target="_blank">http://osgeo-org.1560.x6.nabble.com/IMPORTANT-MapGuide-RFC-136-is-ready-for-review-tp5060534p5060600.html</a>
Sent from the MapGuide Users mailing list archive at Nabble.com.
_______________________________________________
mapguide-users mailing list
<a href="mailto:mapguide-users@lists.osgeo.org" target="_blank">mapguide-users@lists.osgeo.org</a>
<a href="http://lists.osgeo.org/mailman/listinfo/mapguide-users" target="_blank">http://lists.osgeo.org/mailman/listinfo/mapguide-users</a>
</pre>
</blockquote>
<br>
</div></div><div class="im"><div>-- <br>
<hr>
<div> <a href="http://www.gemtec.ca/" target="_blank"><img alt="GEMTEC
Limited" title="Visit the GEMTEC Limited homepage" height="69" width="200"></a>
<p> <strong>Andrew DeMerchant</strong><br>
<br>
tel: 506.453.1025 / toll-free: 1.877.243.6832<br>
fax: 506.453.9470 </p>
</div>
</div>
</div></div>
<br>_______________________________________________<br>
mapguide-users mailing list<br>
<a href="mailto:mapguide-users@lists.osgeo.org">mapguide-users@lists.osgeo.org</a><br>
<a href="http://lists.osgeo.org/mailman/listinfo/mapguide-users" target="_blank">http://lists.osgeo.org/mailman/listinfo/mapguide-users</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Zac Spitzer<br>Solution Architect / Director<br>Ennoble Consultancy Australia<br>+61 405 847 168<br><br>
</div>