user01/calibre-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent SQLI via dbpath

Browse Source 
This is reachable only by the admin users, but is still a straightforward RCE
vector, if only via SQLite's `ATTACH DATABASE` trick
This commit is contained in:
jvoisin
2026-04-14 23:23:12 +02:00
parent 088778969d
commit b5da0df42a
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
cps/db.py
View File

@@ -640,8 +640,8 @@ class CalibreDB:
connect_args={'check_same_thread': False},
poolclass=StaticPool)
with check_engine.begin() as connection:
connection.execute(text("attach database '{}' as calibre;".format(dbpath)))
connection.execute(text("attach database '{}' as app_settings;".format(app_db_path)))
connection.execute(text("attach database '{}' as calibre;".format(dbpath.replace("'", "''"))))
connection.execute(text("attach database '{}' as app_settings;".format(app_db_path.replace("'", "''"))))
local_session = scoped_session(sessionmaker())
local_session.configure(bind=connection)
database_uuid = local_session().query(Library_Id).one_or_none()
@@ -694,8 +694,8 @@ class CalibreDB:
poolclass=StaticPool)
with engine.begin() as connection:
connection.execute(text('PRAGMA cache_size = 10000;'))
connection.execute(text("attach database '{}' as calibre;".format(dbpath)))
connection.execute(text("attach database '{}' as app_settings;".format(app_db_path)))
connection.execute(text("attach database '{}' as calibre;".format(dbpath.replace("'", "''"))))
connection.execute(text("attach database '{}' as app_settings;".format(app_db_path.replace("'", "''"))))
conn = engine.connect()
# conn.text_factory = lambda b: b.decode(errors = 'ignore') possible fix for #1302