Merge pull request #61 from SpecterOps/seanj/BED-7946

fix(pg): escape quoting within formatted string values

Author: kpom-specter

cypher/models/pgsql/format/format.go

@@ -116,7 +116,7 @@ func formatValue(builder *OutputBuilder, value any) error {
 		return formatSlice(builder, typedValue, pgsql.Int8Array)
 
 	case string:
-		builder.Write("'", typedValue, "'")
+		builder.Write("'", strings.ReplaceAll(typedValue, "'", "''"), "'")
 
 	case bool:
 		builder.Write(strconv.FormatBool(typedValue))

cypher/models/pgsql/format/format_test.go

@@ -571,3 +571,31 @@ func TestFormat_CTEs(t *testing.T) {
 	require.Nil(t, err)
 	require.Equal(t, "with recursive expansion_1(root_id, next_id, depth, stop, is_cycle, path) as materialized (select r.start_id, r.end_id, 1, false, r.start_id = r.end_id, array [r.id] from edge r join node a on a.id = r.start_id where a.kind_ids operator (pg_catalog.&&) array [23]::int2[] union all select expansion_1.root_id, r.end_id, expansion_1.depth + 1, b.kind_ids operator (pg_catalog.&&) array [24]::int2[], r.id = any(expansion_1.path), expansion_1.path || r.id from expansion_1 join edge r on r.start_id = expansion_1.next_id join node b on b.id = r.end_id where not expansion_1.is_cycle and not expansion_1.stop) select a.properties, b.properties from expansion_1 join node a on a.id = expansion_1.root_id join node b on b.id = expansion_1.next_id where not expansion_1.is_cycle and expansion_1.stop;", formattedQuery)
 }
+
+func TestFormat_QueryInjection(t *testing.T) {
+	query := pgsql.Query{
+		Body: pgsql.Select{
+			Distinct: false,
+			Projection: []pgsql.SelectItem{
+				pgsql.Wildcard{},
+			},
+			From: []pgsql.FromClause{{
+				Source: pgsql.TableReference{
+					Name:    pgsql.CompoundIdentifier{"table"},
+					Binding: pgsql.AsOptionalIdentifier("t"),
+				},
+			}},
+			Where: pgsql.BinaryExpression{
+				LOperand: pgsql.CompoundIdentifier{"t", "col1"},
+				Operator: pgsql.Operator("="),
+				ROperand: pgsql.Literal{
+					Value: "alpha' || select ('malicious')",
+				},
+			},
+		},
+	}
+
+	formattedQuery, err := format.Statement(query, format.NewOutputBuilder())
+	require.Nil(t, err)
+	require.Equal(t, `select * from table t where t.col1 = 'alpha'' || select (''malicious'')';`, formattedQuery)
+}

cypher/models/pgsql/test/translation_cases/nodes.sql

@@ -312,3 +312,5 @@ with s0 as (select (n0.id, n0.kind_ids, n0.properties)::nodecomposite as n0 from
 -- case: match (n:NodeKind1) optional match (m:NodeKind2) where m.distinguishedname = n.unknown + m.unknown optional match (o:NodeKind2) where o.distinguishedname <> n.otherunknown return n, m, o
 with s0 as (select (n0.id, n0.kind_ids, n0.properties)::nodecomposite as n0 from node n0 where n0.kind_ids operator (pg_catalog.@>) array [1]::int2[]), s1 as (select s0.n0 as n0, (n1.id, n1.kind_ids, n1.properties)::nodecomposite as n1 from s0, node n1 where ((n1.properties ->> 'distinguishedname') = ((s0.n0).properties -> 'unknown') + (n1.properties -> 'unknown')) and n1.kind_ids operator (pg_catalog.@>) array [2]::int2[]), s2 as (select s0.n0 as n0, s1.n1 as n1 from s0 left outer join s1 on (s0.n0 = s1.n0)), s3 as (select s2.n0 as n0, s2.n1 as n1, (n2.id, n2.kind_ids, n2.properties)::nodecomposite as n2 from s2, node n2 where ((n2.properties -> 'distinguishedname') <> ((s2.n0).properties -> 'otherunknown')) and n2.kind_ids operator (pg_catalog.@>) array [2]::int2[]), s4 as (select s2.n0 as n0, s2.n1 as n1, s3.n2 as n2 from s2 left outer join s3 on (s2.n1 = s3.n1) and (s2.n0 = s3.n0)) select s4.n0 as n, s4.n1 as m, s4.n2 as o from s4;
 
+-- case: match (n) where n.name = "alpha' || (SELECT inet_server_addr()::text::int) || '" return n
+with s0 as (select (n0.id, n0.kind_ids, n0.properties)::nodecomposite as n0 from node n0 where ((n0.properties ->> 'name') = 'alpha'' || (SELECT inet_server_addr()::text::int) || ''')) select s0.n0 as n from s0;