DatabaseAuthorizer.cpp [plain text]
#include "config.h"
#include "DatabaseAuthorizer.h"
#include "Database.h"
#include "PlatformString.h"
namespace WebCore {
DatabaseAuthorizer::DatabaseAuthorizer()
: m_securityEnabled(false)
{
reset();
addWhitelistedFunctions();
}
void DatabaseAuthorizer::reset()
{
m_lastActionWasInsert = false;
m_lastActionChangedDatabase = false;
m_readOnly = false;
}
void DatabaseAuthorizer::addWhitelistedFunctions()
{
m_whitelistedFunctions.add("sqlite_rename_table");
m_whitelistedFunctions.add("sqlite_rename_trigger");
m_whitelistedFunctions.add("glob");
m_whitelistedFunctions.add("abs");
m_whitelistedFunctions.add("changes");
m_whitelistedFunctions.add("coalesce");
m_whitelistedFunctions.add("glob");
m_whitelistedFunctions.add("ifnull");
m_whitelistedFunctions.add("hex");
m_whitelistedFunctions.add("last_insert_rowid");
m_whitelistedFunctions.add("length");
m_whitelistedFunctions.add("like");
m_whitelistedFunctions.add("lower");
m_whitelistedFunctions.add("ltrim");
m_whitelistedFunctions.add("max");
m_whitelistedFunctions.add("min");
m_whitelistedFunctions.add("nullif");
m_whitelistedFunctions.add("quote");
m_whitelistedFunctions.add("replace");
m_whitelistedFunctions.add("round");
m_whitelistedFunctions.add("rtrim");
m_whitelistedFunctions.add("soundex");
m_whitelistedFunctions.add("sqlite_source_id");
m_whitelistedFunctions.add("sqlite_version");
m_whitelistedFunctions.add("substr");
m_whitelistedFunctions.add("total_changes");
m_whitelistedFunctions.add("trim");
m_whitelistedFunctions.add("typeof");
m_whitelistedFunctions.add("upper");
m_whitelistedFunctions.add("zeroblob");
m_whitelistedFunctions.add("date");
m_whitelistedFunctions.add("time");
m_whitelistedFunctions.add("datetime");
m_whitelistedFunctions.add("julianday");
m_whitelistedFunctions.add("strftime");
m_whitelistedFunctions.add("avg");
m_whitelistedFunctions.add("count");
m_whitelistedFunctions.add("group_concat");
m_whitelistedFunctions.add("sum");
m_whitelistedFunctions.add("total");
m_whitelistedFunctions.add("snippet");
m_whitelistedFunctions.add("offsets");
m_whitelistedFunctions.add("optimize");
m_whitelistedFunctions.add("regexp");
}
int DatabaseAuthorizer::createTable(const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
m_lastActionChangedDatabase = true;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::createTempTable(const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::dropTable(const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::dropTempTable(const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::allowAlterTable(const String&, const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
m_lastActionChangedDatabase = true;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::createIndex(const String&, const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
m_lastActionChangedDatabase = true;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::createTempIndex(const String&, const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::dropIndex(const String&, const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::dropTempIndex(const String&, const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::createTrigger(const String&, const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
m_lastActionChangedDatabase = true;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::createTempTrigger(const String&, const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::dropTrigger(const String&, const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::dropTempTrigger(const String&, const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::createView(const String&)
{
return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
}
int DatabaseAuthorizer::createTempView(const String&)
{
return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
}
int DatabaseAuthorizer::dropView(const String&)
{
return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
}
int DatabaseAuthorizer::dropTempView(const String&)
{
return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
}
int DatabaseAuthorizer::createVTable(const String& tableName, const String& moduleName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
if (moduleName != "fts2")
return SQLAuthDeny;
m_lastActionChangedDatabase = true;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::dropVTable(const String& tableName, const String& moduleName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
if (moduleName != "fts2")
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::allowDelete(const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::allowInsert(const String& tableName)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
m_lastActionChangedDatabase = true;
m_lastActionWasInsert = true;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::allowUpdate(const String& tableName, const String&)
{
if (m_readOnly && m_securityEnabled)
return SQLAuthDeny;
m_lastActionChangedDatabase = true;
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::allowTransaction()
{
return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
}
int DatabaseAuthorizer::allowRead(const String& tableName, const String&)
{
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::allowReindex(const String&)
{
return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
}
int DatabaseAuthorizer::allowAnalyze(const String& tableName)
{
return denyBasedOnTableName(tableName);
}
int DatabaseAuthorizer::allowPragma(const String&, const String&)
{
return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
}
int DatabaseAuthorizer::allowAttach(const String&)
{
return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
}
int DatabaseAuthorizer::allowDetach(const String&)
{
return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
}
int DatabaseAuthorizer::allowFunction(const String& functionName)
{
if (m_securityEnabled && !m_whitelistedFunctions.contains(functionName))
return SQLAuthDeny;
return SQLAuthAllow;
}
void DatabaseAuthorizer::disable()
{
m_securityEnabled = false;
}
void DatabaseAuthorizer::enable()
{
m_securityEnabled = true;
}
void DatabaseAuthorizer::setReadOnly()
{
m_readOnly = true;
}
int DatabaseAuthorizer::denyBasedOnTableName(const String& tableName)
{
if (!m_securityEnabled)
return SQLAuthAllow;
if (equalIgnoringCase(tableName, Database::databaseInfoTableName()))
return SQLAuthDeny;
return SQLAuthAllow;
}
}