Ticket #36 (new enhancement)

Opened 3 years ago

Prevent SQL Injections coming from the requets

Reported by: assefa Owned by:
Priority: minor Version: SVN
Keywords: Cc:
Triage Stage: Unreviewed State of Approval: Unnecessary
Attached Patches: None Complexity: Unknown
Compatibility: Unknown Specification: Unnecessary

Description

This bug is to trac any issues/solutions that needs to be implemented to prevent any kind of SQL injections through wfs requests. An interesting read at: http://www.securityfocus.com/infocus/1768.

Initial comments by Olivier: "All the controls and checks should be done for common parameter in ows_request.c

Filter Encoding is a specific one, as we could only check at this stage that it validate against FE Schema. And we use some of the FE content to build SQL query. So there's a specific risk there."

Note: See TracTickets for help on using tickets.