<div dir="auto">Typically when there is a risk that the geometry column could be null (like in most databases) I connect to a filtered view of the data rather than the table itself.<div dir="auto"><br><div dir="auto">Just for those cases where I can't enforce a non-null geometry (like a trigger with x/y columns)</div><div dir="auto"><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 28, 2021, 8:38 AM Kyel Shippey <<a href="mailto:kshippey@juno.com">kshippey@juno.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word"><div class="m_-8789907956400271558WordSection1"><p class="MsoNormal">Hello all,<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">We recently experienced a vulnerability in MapGuide when encountering a feature selection that contains “empty” geometries in SQLite. We have not examined whether it occurs in other file or database formats as well. We are operating on MapGuide 3.1.2 in 64-bit Windows with FDO 4.1 with PHP scripting.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Empty geometries seem to include WKT values such as:<u></u><u></u></p><p class="MsoNormal"> POINT()<u></u><u></u></p><p class="MsoNormal"> LINESTRING()<u></u><u></u></p><p class="MsoNormal"> POLYGON()<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">When looping over an MgFeatureReader collection that contains a feature like this, the logic fails when merely attempting to access the affected feature, so there is no opportunity to detect and gracefully bypass it:<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">while($features->ReadNext()) {<u></u><u></u></p><p class="MsoNormal" style="text-indent:.5in">// breaks down before anything can happen<u></u><u></u></p><p class="MsoNormal" style="text-indent:.5in">// if this current item has an “empty” geometry<u></u><u></u></p><p class="MsoNormal">}<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">On our system, the failure is repeatably complete and devastating, requiring a full server reset which often does not suffice without additional monkeying on the /Repositores/Library/ and /Repositories/Site/ database files, suggesting that some file database corruption might occur with this event.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">For our purposes, we had success in sanitizing our SQLite files by first processing them through GeoJSON. From there, ogr2ogr can utilize the AsText() in its sqlite dialect query and prevent these known culprits from propagating into our SQLite files library. But the underlying vulnerability still exists, whether on the MapGuide internals side or just for the SQLite FDO provider.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">This seemed worth bringing to everyone’s attention for consideration on the compiled engine code. I can provide a sample SQLite file for investigation if you like.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Thank you,<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Kyel Shippey<u></u><u></u></p></div></div>
<br><br><font size="2" color="#000000">____________________________________________________________</font><br><br><font face="Arial"><font color="#000000" size="2">Top News - <a style="TEXT-DECORATION:none" href="https://www.newser.com/?utm_source=part&utm_medium=uol&utm_campaign=rss_taglines_more" target="_blank" rel="noreferrer">Sponsored By Newser</a></font><ul><li><a style="TEXT-DECORATION:none" href="http://thirdpartyoffers.juno.com/TGL3132/60890f43a94bcf422e95st02vuc1" target="_blank" rel="noreferrer"><font color="#004080" size="2"><b>NY Post Reporter Who Wrote Fake 'Kam On In' Story Is Out</b></font></a></li><li><a style="TEXT-DECORATION:none" href="http://thirdpartyoffers.juno.com/TGL3132/60890f43ccc22f422e95st02vuc2" target="_blank" rel="noreferrer"><font color="#004080" size="2"><b>Autopsy: Andrew Brown Was Shot 5 Times</b></font></a></li><li><a style="TEXT-DECORATION:none" href="http://thirdpartyoffers.juno.com/TGL3132/60890f43f01bbf422e95st02vuc3" target="_blank" rel="noreferrer"><font color="#004080" size="2"><b>Appalachian Trail Killer Headed to Psych Facility</b></font></a></li></ul></font>_______________________________________________<br>
mapguide-users mailing list<br>
<a href="mailto:mapguide-users@lists.osgeo.org" target="_blank" rel="noreferrer">mapguide-users@lists.osgeo.org</a><br>
<a href="https://lists.osgeo.org/mailman/listinfo/mapguide-users" rel="noreferrer noreferrer" target="_blank">https://lists.osgeo.org/mailman/listinfo/mapguide-users</a><br>
</blockquote></div>