1d5cb6a53674b76c2f8d4f8413a69b10124d9cbc galt Wed Oct 5 16:02:16 2022 -0700 Fixing a few more minor bugs for sqlSafef V2 in CIRM cdwWebBrowse. diff --git src/hg/cirm/cdw/cdwWebBrowse/cdwWebBrowse.c src/hg/cirm/cdw/cdwWebBrowse/cdwWebBrowse.c index 6c4359e..a947a3b 100644 --- src/hg/cirm/cdw/cdwWebBrowse/cdwWebBrowse.c +++ src/hg/cirm/cdw/cdwWebBrowse/cdwWebBrowse.c @@ -917,32 +917,34 @@ if (slCount(sff->valList)>0) { sqlDyStringPrintf(facetedWhere, " and "); // use Frag to prevent NOSQLINJ tag sqlDyStringPrintf(facetedWhere, "ifnull(%s,'n/a') in (", sff->fieldName); struct facetVal *el; for (el=sff->valList; el; el=el->next) { sqlDyStringPrintf(facetedWhere, "'%s'", el->val); if (el->next) sqlDyStringPrintf(facetedWhere, ","); } sqlDyStringPrintf(facetedWhere, ")"); } } + // get their fileIds struct dyString *tagQuery = sqlDyStringCreate("SELECT file_id from %s %-s", table, filteredWhere->string); // trust +if (!isEmpty(facetedWhere->string)) sqlDyStringPrintf(tagQuery, "%-s", facetedWhere->string); // trust because it was created safely struct slName *fileIds = sqlQuickList(conn, tagQuery->string); // retrieve the cdwFiles objects for these struct dyString *fileQuery = sqlDyStringCreate("SELECT * FROM cdwFile WHERE id IN ("); sqlDyStringPrintValuesList(fileQuery, fileIds); sqlDyStringPrintf(fileQuery, ")"); return cdwFileLoadByQuery(conn, fileQuery->string); } static void continueSearchVars() /* print out hidden forms variables for the current search */ { cgiContinueHiddenVar("cdwFileSearch"); char *fieldNames[128]; @@ -1618,31 +1620,37 @@ sqlDyStringPrintf(sqlQuery, "%s", l->name); l = l->next; while (l != NULL) { sqlDyStringPrintf(sqlQuery, ",%s", l->name); l = l->next; } sqlDyStringPrintf(sqlQuery, " from cdwFileTags"); int whereClauseStarted = 0; if (!isEmpty(where)) { // Can't use sqlDyString functions due to the possible presence of valid wildcards, but // the while clause has already been validated by passing through the more restrictive // rql parser anyway. - sqlDyStringPrintf(sqlQuery, " where %-s", rqlParseToSqlWhereClause(rql->whereClause, FALSE)); + + // Note currently unable to use sqlSafefV2 inside /src/lib/rqlParse* since it needs functions in /src/hg/lib/jksql.c + // and things in /src/lib are not supposed to use and depend on stuff under /src/hg/lib. + char *rqlWhere = rqlParseToSqlWhereClause(rql->whereClause, FALSE); + char trustedQuery[strlen(rqlWhere) + NOSQLINJ_SIZE + 1]; + safef(trustedQuery, sizeof trustedQuery, NOSQLINJ "%s", rqlWhere); + sqlDyStringPrintf(sqlQuery, " where %-s", trustedQuery); whereClauseStarted = 1; } // Ensure the user has access to the data. Access means either it's a public set (allAccess = 1) or one of the user's // associated group IDs appears in the groupIds field (or they're an admin). if ((user == NULL) || (!user->isAdmin)) { if (whereClauseStarted == 0) { sqlDyStringPrintf(sqlQuery, " where "); whereClauseStarted = 1; } else sqlDyStringPrintf(sqlQuery, " and "); sqlDyStringPrintf(sqlQuery, "(allAccess = 1");