Fix a vulnerable query from sql injection
[platform/core/appfw/pkgmgr-info.git] / src / pkgmgrinfo_appinfo.c
index a25f671..1529a85 100644 (file)
@@ -68,8 +68,8 @@ static int _get_filtered_query(pkgmgrinfo_filter_x *filter,
                        "(SELECT package FROM package_info WHERE package_disable='false')";
        GSList *list;
 
-       len += strlen(" WHERE 1=1");
        strncat(buf, " WHERE 1=1", MAX_QUERY_LEN - len - 1);
+       len += strlen(" WHERE 1=1");
 
        if (filter == NULL) {
                strncat(buf, query_pkg_disable, MAX_QUERY_LEN - len - 1);
@@ -82,35 +82,35 @@ static int _get_filtered_query(pkgmgrinfo_filter_x *filter,
                if (condition == NULL)
                        continue;
 
-               len += strlen(" AND ");
                strncat(buf, " AND ", MAX_QUERY_LEN - len - 1);
+               len += strlen(" AND ");
 
-               len += strlen(condition);
                strncat(buf, condition, sizeof(buf) - len - 1);
+               len += strlen(condition);
                free(condition);
                condition = NULL;
        }
 
        if (filter->list_metadata) {
-               len += strlen(" AND (");
                strncat(buf, " AND (", MAX_QUERY_LEN - len - 1);
+               len += strlen(" AND (");
        }
        for (list = filter->list_metadata; list; list = list->next) {
                joined |= __get_metadata_filter_condition(list->data,
                                &condition, bind_params);
                if (condition == NULL)
                        continue;
-               len += strlen(condition);
                strncat(buf, condition, sizeof(buf) - len - 1);
+               len += strlen(condition);
                free(condition);
                condition = NULL;
 
-               len += strlen(" OR ");
                strncat(buf, " OR ", MAX_QUERY_LEN - len - 1);
+               len += strlen(" OR ");
        }
        if (filter->list_metadata) {
-               len += strlen("1=0)");
                strncat(buf, "1=0)", MAX_QUERY_LEN - len - 1);
+               len += strlen("1=0)");
        }
 
        if (joined & E_PMINFO_APPINFO_JOIN_LOCALIZED_INFO) {
@@ -135,8 +135,8 @@ static int _get_filtered_query(pkgmgrinfo_filter_x *filter,
                len += strlen(join_appinfo_for_uid);
        }
        strncat(tmp_query, buf, MAX_QUERY_LEN - len - 1);
-
        len += strlen(buf);
+
        strncat(tmp_query, query_pkg_disable, MAX_QUERY_LEN - len - 1);
 
        *query = strdup(tmp_query);
@@ -254,7 +254,7 @@ static int _appinfo_get_data_control(sqlite3 *db, const char *appid,
                GList **datacontrol)
 {
        static const char query_raw[] =
-               "SELECT providerid, access, type "
+               "SELECT providerid, access, type, trusted "
                "FROM package_app_data_control WHERE app_id=%Q";
        int ret;
        char *query;
@@ -286,6 +286,7 @@ static int _appinfo_get_data_control(sqlite3 *db, const char *appid,
                _save_column_str(stmt, idx++, &info->providerid);
                _save_column_str(stmt, idx++, &info->access);
                _save_column_str(stmt, idx++, &info->type);
+               _save_column_str(stmt, idx++, &info->trusted);
                *datacontrol = g_list_append(*datacontrol, info);
        }
 
@@ -430,7 +431,7 @@ static int __get_appinfo_for_uid(sqlite3 *db, application_x *info, uid_t uid)
 {
        static const char query_raw[] =
                "SELECT is_splash_screen_enabled, is_disabled "
-               "FROM package_app_info_for_uid WHERE app_id='%s' AND uid='%d'";
+               "FROM package_app_info_for_uid WHERE app_id=%Q AND uid=%d";
        int ret;
        char *query;
        char *is_disabled = NULL;
@@ -563,7 +564,7 @@ static int _appinfo_get_applications(uid_t db_uid, uid_t uid,
                "ai.app_zip_mount_file, ai.component_type, ai.package, "
                "ai.app_external_path, ai.app_package_system, ai.app_removable, "
                "ai.app_package_installed_time, ai.app_support_mode, "
-               "ai.app_support_ambient";
+               "ai.app_support_ambient, ai.app_setup_appid";
        static const char query_label[] =
                ", COALESCE("
                "(SELECT app_label FROM package_app_localized_info WHERE ai.app_id=app_id AND app_locale=?), "
@@ -699,6 +700,7 @@ static int _appinfo_get_applications(uid_t db_uid, uid_t uid,
                _save_column_str(stmt, idx++, &info->package_installed_time);
                _save_column_str(stmt, idx++, &info->support_mode);
                _save_column_str(stmt, idx++, &info->support_ambient);
+               _save_column_str(stmt, idx++, &info->setup_appid);
 
                info->for_all_users =
                        strdup((db_uid != GLOBAL_USER) ? "false" : "true");
@@ -1080,6 +1082,8 @@ static gpointer __copy_datacontrol(gconstpointer src, gpointer data)
                datacontrol->access = strdup(tmp->access);
        if (tmp->type)
                datacontrol->type = strdup(tmp->type);
+       if (tmp->trusted)
+               datacontrol->trusted = strdup(tmp->trusted);
 
        return datacontrol;
 }
@@ -2249,7 +2253,8 @@ API int pkgmgrinfo_appinfo_get_installed_time(pkgmgrinfo_appinfo_h handle, int *
        return PMINFO_R_OK;
 }
 
-API int pkgmgrinfo_appinfo_usr_get_datacontrol_info(const char *providerid, const char *type, uid_t uid, char **appid, char **access)
+API int pkgmgrinfo_appinfo_usr_get_datacontrol_info(const char *providerid,
+               const char *type, uid_t uid, char **appid, char **access)
 {
        retvm_if(providerid == NULL, PMINFO_R_EINVAL, "Argument supplied is NULL\n");
        retvm_if(type == NULL, PMINFO_R_EINVAL, "Argument supplied is NULL\n");
@@ -2288,9 +2293,11 @@ catch:
        return ret;
 }
 
-API int pkgmgrinfo_appinfo_get_datacontrol_info(const char *providerid, const char *type, char **appid, char **access)
+API int pkgmgrinfo_appinfo_get_datacontrol_info(const char *providerid,
+               const char *type, char **appid, char **access)
 {
-       return pkgmgrinfo_appinfo_usr_get_datacontrol_info(providerid, type, _getuid(), appid, access);
+       return pkgmgrinfo_appinfo_usr_get_datacontrol_info(providerid,
+                       type, _getuid(), appid, access);
 }
 
 API int pkgmgrinfo_appinfo_usr_get_datacontrol_appid(const char *providerid, uid_t uid, char **appid)
@@ -2334,6 +2341,52 @@ API int pkgmgrinfo_appinfo_get_datacontrol_appid(const char *providerid, char **
        return pkgmgrinfo_appinfo_usr_get_datacontrol_appid(providerid, _getuid(), appid);
 }
 
+API int pkgmgrinfo_appinfo_usr_get_datacontrol_trusted_info(const char *providerid,
+               const char *type, uid_t uid, char **appid, bool *is_trusted)
+{
+       retvm_if(providerid == NULL, PMINFO_R_EINVAL, "Argument supplied is NULL\n");
+       retvm_if(appid == NULL, PMINFO_R_EINVAL, "Argument supplied to hold return value is NULL\n");
+
+       int ret = PMINFO_R_OK;
+       char *query = NULL;
+       sqlite3_stmt *stmt = NULL;
+
+       /*open db*/
+       ret = __open_manifest_db(uid, true);
+       retvm_if(ret != SQLITE_OK, ret = PMINFO_R_ERROR, "connect db [%s] failed!", MANIFEST_DB);
+
+       /*Start constructing query*/
+       query = sqlite3_mprintf("SELECT app_id, trusted FROM package_app_data_control WHERE providerid=%Q AND type=%Q", providerid, type);
+       tryvm_if(query == NULL, ret = PMINFO_R_ERROR, "Out of memory");
+
+       /*prepare query*/
+       ret = sqlite3_prepare_v2(GET_DB(manifest_db), query, strlen(query), &stmt, NULL);
+       tryvm_if(ret != PMINFO_R_OK, ret = PMINFO_R_ERROR, "sqlite3_prepare_v2 failed[%s]\n", query);
+
+       /*step query*/
+       ret = sqlite3_step(stmt);
+       tryvm_if((ret != SQLITE_ROW) || (ret == SQLITE_DONE), ret = PMINFO_R_ERROR, "No records found");
+
+       _save_column_str(stmt, 0, appid);
+       *is_trusted = _get_bool_value((char *)sqlite3_column_text(stmt, 1));
+
+       ret = PMINFO_R_OK;
+
+catch:
+       sqlite3_free(query);
+       sqlite3_finalize(stmt);
+       __close_manifest_db();
+       return ret;
+}
+
+API int pkgmgrinfo_appinfo_get_datacontrol_trsuted_info(const char *providerid,
+               const char *type, char **appid, bool *is_trusted)
+{
+       return pkgmgrinfo_appinfo_usr_get_datacontrol_trusted_info(providerid,
+                       type, _getuid(), appid, is_trusted);
+}
+
+
 API int pkgmgrinfo_appinfo_get_support_mode(pkgmgrinfo_appinfo_h  handle, int *support_mode)
 {
        retvm_if(handle == NULL, PMINFO_R_EINVAL, "appinfo handle is NULL");
@@ -2799,6 +2852,22 @@ API int pkgmgrinfo_appinfo_get_splash_screen_display(pkgmgrinfo_appinfo_h handle
        return PMINFO_R_OK;
 }
 
+API int pkgmgrinfo_appinfo_get_setup_appid(pkgmgrinfo_appinfo_h handle, char **setup_appid)
+{
+       pkgmgr_appinfo_x *info = (pkgmgr_appinfo_x *)handle;
+
+       if (info == NULL || setup_appid == NULL) {
+               _LOGE("Invalid parameter");
+               return PMINFO_R_EINVAL;
+       }
+
+       if (info->app_info == NULL || info->app_info->setup_appid == NULL)
+               return PMINFO_R_ERROR;
+
+       *setup_appid = info->app_info->setup_appid;
+       return PMINFO_R_OK;
+}
+
 API int pkgmgrinfo_appinfo_is_support_ambient(pkgmgrinfo_appinfo_h handle,
                bool *support_ambient)
 {