fix(security): sanitize timezone parameter value to prevent code injection (#2608)

* fix(security): sanitize timezone parameter value to prevent code injection. Discovered by zhaoyudi (Nebulalab）

Author: sidorares

lib/parsers/binary_parser.js

@@ -42,9 +42,9 @@ function readCodeFor(field, config, options, fieldNum) {
  case Types.TIMESTAMP:
  case Types.NEWDATE:
  if (helpers.typeMatch(field.columnType, dateStrings, Types)) {
- return `packet.readDateTimeString(${field.decimals});`;
+ return `packet.readDateTimeString(${parseInt(field.decimals, 10)});`;
  }
- return `packet.readDateTime('${timezone}');`;
+ return `packet.readDateTime(${helpers.srcEscape(timezone)});`;
  case Types.TIME:
  return 'packet.readTimeString()';
  case Types.DECIMAL:

lib/parsers/text_parser.js

@@ -48,13 +48,13 @@ function readCodeFor(type, charset, encodingExpr, config, options) {
  if (helpers.typeMatch(type, dateStrings, Types)) {
  return 'packet.readLengthCodedString("ascii")';
  }
- return `packet.parseDate('${timezone}')`;
+ return `packet.parseDate(${helpers.srcEscape(timezone)})`;
  case Types.DATETIME:
  case Types.TIMESTAMP:
  if (helpers.typeMatch(type, dateStrings, Types)) {
  return 'packet.readLengthCodedString("ascii")';
  }
- return `packet.parseDateTime('${timezone}')`;
+ return `packet.parseDateTime(${helpers.srcEscape(timezone)})`;
  case Types.TIME:
  return 'packet.readLengthCodedString("ascii")';
  case Types.GEOMETRY:

test/esm/unit/parsers/timezone-binary-sanitization.test.mjs

@@ -0,0 +1,24 @@
+import { describe, test, assert } from 'poku';
+import { createConnection, describeOptions } from '../../../common.test.cjs';
+
+const connection = createConnection().promise();
+
+describe('Binary Parser: timezone Sanitization', describeOptions);
+
+Promise.all([
+ test(async () => {
+ process.env.TEST_ENV_VALUE = 'secure';
+ await connection.execute({
+ sql: 'SELECT NOW()',
+ timezone: `'); process.env.TEST_ENV_VALUE = "not so much"; //`,
+ });
+
+ assert.strictEqual(
+ process.env.TEST_ENV_VALUE,
+ 'secure',
+ 'Timezone sanitization failed - code injection possible',
+ );
+ }),
+]).then(async () => {
+ await connection.end();
+});

test/esm/unit/parsers/timezone-text-sanitization.test.mjs

@@ -0,0 +1,24 @@
+import { describe, test, assert } from 'poku';
+import { createConnection, describeOptions } from '../../../common.test.cjs';
+
+const connection = createConnection().promise();
+
+describe('Text Parser: timezone Sanitization', describeOptions);
+
+Promise.all([
+ test(async () => {
+ process.env.TEST_ENV_VALUE = 'secure';
+ await connection.query({
+ sql: 'SELECT NOW()',
+ timezone: `'); process.env.TEST_ENV_VALUE = "not so much"; //`,
+ });
+
+ assert.strictEqual(
+ process.env.TEST_ENV_VALUE,
+ 'secure',
+ 'Timezone sanitization failed - code injection possible',
+ );
+ }),
+]).then(async () => {
+ await connection.end();
+});