From ff68c22161071ce89851c6d81e80ba51b67e8e0c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Mon, 13 Feb 2023 13:56:10 +0000 Subject: [PATCH] disable script dump Change-Id: I04d740cc0fcf87daa192a0a6af34138278043a19 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/146986 Tested-by: Jenkins Reviewed-by: Thorsten Behrens Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147051 Tested-by: Thorsten Behrens Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147255 Tested-by: Jenkins CollaboraOffice Reviewed-by: Andras Timar (cherry picked from commit ae3a7dcbb60bb73700737b9ca8940ce3103648d9) --- .../source/drivers/hsqldb/HDriver.cxx | 31 +++++++++++++++++++ external/hsqldb/UnpackedTarball_hsqldb.mk | 1 + .../hsqldb/patches/disable-dump-script.patch | 14 +++++++++ 3 files changed, 46 insertions(+) create mode 100644 external/hsqldb/patches/disable-dump-script.patch diff --git a/connectivity/source/drivers/hsqldb/HDriver.cxx b/connectivity/source/drivers/hsqldb/HDriver.cxx index de76ecbba29de..95c610843efab 100644 --- a/connectivity/source/drivers/hsqldb/HDriver.cxx +++ b/connectivity/source/drivers/hsqldb/HDriver.cxx @@ -300,6 +300,37 @@ namespace connectivity } // if ( xStream.is() ) ::comphelper::disposeComponent(xStream); } + + // disallow any database/script files that contain a "SCRIPT[.*]" entry (this is belt and braces + // in that bundled hsqldb 1.8.0 is patched to also reject them) + // + // hsqldb 2.6.0 release notes have: added system role SCRIPT_OPS for export / import of database structure and data + // which seems to provide a builtin way to do this with contemporary hsqldb + const OUString sScript( "script" ); + if (!bIsNewDatabase && xStorage->isStreamElement(sScript)) + { + Reference xStream = xStorage->openStreamElement(sScript, ElementModes::READ); + if (xStream.is()) + { + std::unique_ptr pStream(::utl::UcbStreamHelper::CreateStream(xStream)); + if (pStream) + { + OString sLine; + while (pStream->ReadLine(sLine)) + { + OString sText = sLine.trim(); + if (sText.startsWithIgnoreAsciiCase("SCRIPT")) + { + ::connectivity::SharedResources aResources; + sMessage = aResources.getResourceString(STR_COULD_NOT_LOAD_FILE).replaceFirst("$filename$", sSystemPath); + break; + } + } + } + } // if ( xStream.is() ) + ::comphelper::disposeComponent(xStream); + } + } catch(Exception&) { diff --git a/external/hsqldb/UnpackedTarball_hsqldb.mk b/external/hsqldb/UnpackedTarball_hsqldb.mk index cbba770f19a07..ed262cccf4caa 100644 --- a/external/hsqldb/UnpackedTarball_hsqldb.mk +++ b/external/hsqldb/UnpackedTarball_hsqldb.mk @@ -29,6 +29,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,hsqldb,\ external/hsqldb/patches/jdbc-4.1.patch \ external/hsqldb/patches/multipleResultSets.patch \ ) \ + external/hsqldb/patches/disable-dump-script.patch \ )) # vim: set noet sw=4 ts=4: diff --git a/external/hsqldb/patches/disable-dump-script.patch b/external/hsqldb/patches/disable-dump-script.patch new file mode 100644 index 0000000000000..401dd38abc9a2 --- /dev/null +++ b/external/hsqldb/patches/disable-dump-script.patch @@ -0,0 +1,14 @@ +--- a/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java 2023-02-13 11:08:11.297243034 +0000 ++++ b/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java 2023-02-13 13:49:17.973089433 +0000 +@@ -403,6 +403,11 @@ + throw Trace.error(Trace.INVALID_IDENTIFIER); + } + ++ // added condition to avoid execution of spurious command in .script or .log file ++ if (session.isProcessingScript() || session.isProcessingLog()) { ++ return new Result(ResultConstants.UPDATECOUNT); ++ } ++ + dsw = new ScriptWriterText(database, token, true, true, true); + + dsw.writeAll(); -- 2.41.0