fix security defect in block checking module

Change-Id: I8c856785ebe088ed326138cb0881dc84dc22ad28
Signed-off-by: Jongkyu Koo <jk.koo@samsung.com>

diff --git a/daemon/phnd-blocking_rule.c b/daemon/phnd-blocking_rule.c
index bba0061def7fa374c118085d7f133a518bcacb9f..2a6c04333b1b934f32fd4445b7407f0108124b68 100644 (file)
--- a/daemon/phnd-blocking_rule.c
+++ b/daemon/phnd-blocking_rule.c
@@ -355,20 +355,20 @@ int phnd_blocking_rule_check(int user_id, const char *number, int *is_blocked)
        ret = snprintf(query, sizeof(query), "SELECT count(*) FROM "PHND_TABLE_BLOCKNUMBER" "
                        "WHERE user_id = %d AND (CASE "
                        "WHEN match_type = %d "
-                       "THEN '%s' = number OR '%s' = normalized_number "
+                       "THEN ? = number OR '%s' = normalized_number "
                        "WHEN match_type = %d "
-                       "THEN SUBSTR('%s', 1, LENGTH(number)) = number OR "
+                       "THEN SUBSTR(?, 1, LENGTH(number)) = number OR "
                        "SUBSTR('%s', 1, LENGTH(normalized_number)) = normalized_number "
                        "WHEN match_type = %d "
-                       "THEN SUBSTR('%s', -LENGTH(normalized_number)) = number "
+                       "THEN SUBSTR(?, -LENGTH(normalized_number)) = number "
                        "WHEN match_type = %d "
-                       "THEN INSTR('%s', number) "
+                       "THEN INSTR(?, number) "
                        "END) ",
                        user_id,
-                       PHONE_NUMBER_MATCH_TYPE_EXACTLY, number, normalized,
-                       PHONE_NUMBER_MATCH_TYPE_STARTS_WITH, number, normalized,
-                       PHONE_NUMBER_MATCH_TYPE_ENDS_WITH, number,
-                       PHONE_NUMBER_MATCH_TYPE_INCLUDES, number);
+                       PHONE_NUMBER_MATCH_TYPE_EXACTLY, normalized,
+                       PHONE_NUMBER_MATCH_TYPE_STARTS_WITH, normalized,
+                       PHONE_NUMBER_MATCH_TYPE_ENDS_WITH,
+                       PHONE_NUMBER_MATCH_TYPE_INCLUDES);
 
        DBG("query : %s", query);
 
@@ -382,6 +382,10 @@ int phnd_blocking_rule_check(int user_id, const char *number, int *is_blocked)
                return ret;
                /* LCOV_EXCL_STOP */
        }
+
+       for (int i = 1; i <= 4; i++)
+               sqlite3_bind_text(stmt, i, number, strlen(number), SQLITE_STATIC);
+
        int count = 0;
        if (PHND_SQLITE_ROW == phnd_sqlite_step(stmt))
                count = sqlite3_column_int(stmt, 0);