Skip to content

Commit e8500df

Browse files
tintoutintou
committed
WindowStateSaver: Avoid sql injections by using sqlite statements
This is the proper way to create SQL queries. Also make sure to not save unmaped windows.
1 parent a32bf93 commit e8500df

File tree

1 file changed

+72
-38
lines changed

1 file changed

+72
-38
lines changed

‎src/WindowStateSaver.vala‎

Lines changed: 72 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ public class Gala.WindowStateSaver : GLib.Object {
7676
}
7777

7878
public static void on_map (Meta.Window window) {
79-
var app_id = GLib.Markup.escape_text (window_tracker.get_app_for_window (window).id);
79+
var app_id = window_tracker.get_app_for_window (window).id;
8080

8181
if (app_id.has_prefix ("window:")) {
8282
// if window failed to be identified, don't remember it
@@ -98,41 +98,65 @@ public class Gala.WindowStateSaver : GLib.Object {
9898
var window_index = find_window_index (window, app_id);
9999
app_windows[app_id].insert_val (window_index, window);
100100

101-
var tracking_window = false;
102-
db.exec (
103-
"SELECT last_x, last_y, last_width, last_height FROM apps WHERE app_id = '%s' AND window_index = '%d';".printf (app_id, window_index),
104-
(n_columns, values, column_names) => {
105-
window.move_resize_frame (false, int.parse (values[0]), int.parse (values[1]), int.parse (values[2]), int.parse (values[3]));
106-
track_window (window, app_id);
107-
tracking_window = true;
101+
Sqlite.Statement stmt;
102+
const string SELECT_QUERY = "SELECT last_x, last_y, last_width, last_height FROM apps WHERE app_id = $app_id AND window_index = $window_index;";
103+
var rc = db.prepare_v2 (SELECT_QUERY, SELECT_QUERY.length, out stmt);
104+
stmt.bind_text (stmt.bind_parameter_index ("$app_id"), app_id);
105+
stmt.bind_int (stmt.bind_parameter_index ("$window_index"), window_index);
106+
if (rc != Sqlite.OK) {
107+
critical ("Cannot query app information from database: %d, %s", rc, db.errmsg ());
108+
return;
109+
}
110+
111+
int cols = stmt.column_count ();
112+
if (stmt.step () == Sqlite.ROW) {
113+
int last_x = 0, last_y = 0, last_width = 0, last_height = 0;
114+
for (int i = 0; i < cols; i++) {
115+
if (stmt.column_name (i) == "last_x") {
116+
last_x = stmt.column_int (i);
117+
}
108118

109-
return 0;
119+
if (stmt.column_name (i) == "last_y") {
120+
last_y = stmt.column_int (i);
121+
}
122+
123+
if (stmt.column_name (i) == "last_width") {
124+
last_width = stmt.column_int (i);
125+
}
126+
127+
if (stmt.column_name (i) == "last_height") {
128+
last_height = stmt.column_int (i);
129+
}
110130
}
111-
);
112131

113-
if (tracking_window) {
114-
// App was added in callback
132+
window.move_resize_frame (false, last_x, last_y, last_width, last_height);
133+
track_window (window, app_id);
115134
return;
116135
}
117136

118137
var frame_rect = window.get_frame_rect ();
119138

120-
Sqlite.Statement stmt;
121-
var rc = db.prepare_v2 (
122-
"INSERT INTO apps (app_id, window_index, last_x, last_y, last_width, last_height) VALUES ('%s', '%d', '%d', '%d', '%d', '%d');"
123-
.printf (app_id, window_index, frame_rect.x, frame_rect.y, frame_rect.width, frame_rect.height),
124-
-1, out stmt
125-
);
139+
const string INSERT_QUERY = "INSERT INTO apps (app_id, window_index, last_x, last_y, last_width, last_height) VALUES ($app_id, $window_index, $last_x, $last_y, $last_width, $last_height);";
140+
rc = db.prepare_v2 (INSERT_QUERY, INSERT_QUERY.length, out stmt);
141+
if (rc != Sqlite.OK) {
142+
critical ("Cannot insert app information into database: %d, %s", rc, db.errmsg ());
143+
return;
144+
}
126145

127-
if (rc == Sqlite.OK) {
128-
rc = stmt.step ();
129-
if (rc == Sqlite.DONE) {
130-
track_window (window, app_id);
131-
return;
132-
}
146+
stmt.bind_text (stmt.bind_parameter_index ("$app_id"), app_id);
147+
stmt.bind_int (stmt.bind_parameter_index ("$window_index"), window_index);
148+
stmt.bind_int (stmt.bind_parameter_index ("$last_x"), frame_rect.x);
149+
stmt.bind_int (stmt.bind_parameter_index ("$last_y"), frame_rect.y);
150+
stmt.bind_int (stmt.bind_parameter_index ("$last_width"), frame_rect.width);
151+
stmt.bind_int (stmt.bind_parameter_index ("$last_height"), frame_rect.height);
152+
153+
rc = stmt.step ();
154+
if (rc != Sqlite.DONE) {
155+
critical ("Cannot insert app information into database: %d, %s", rc, db.errmsg ());
156+
return;
133157
}
134158

135-
critical ("Cannot insert app information into database: %d, %s", rc, db.errmsg ());
159+
track_window (window, app_id);
136160
}
137161

138162
public static void on_shutdown () {
@@ -144,7 +168,12 @@ public class Gala.WindowStateSaver : GLib.Object {
144168
}
145169

146170
private static void save_window_state (Meta.Window window) {
147-
var app_id = GLib.Markup.escape_text (window_tracker.get_app_for_window (window).id);
171+
var app_id = window_tracker.get_app_for_window (window).id;
172+
173+
if (!(app_id in app_windows)) {
174+
critical ("Could not save window that is not mapped %s", app_id);
175+
return;
176+
}
148177

149178
var window_index = find_window_index (window, app_id);
150179
if (window_index < app_windows[app_id].length) {
@@ -157,20 +186,25 @@ public class Gala.WindowStateSaver : GLib.Object {
157186
var frame_rect = window.get_frame_rect ();
158187

159188
Sqlite.Statement stmt;
160-
var rc = db.prepare_v2 (
161-
"UPDATE apps SET last_x = '%d', last_y = '%d', last_width = '%d', last_height = '%d' WHERE app_id = '%s' AND window_index = '%d';"
162-
.printf (frame_rect.x, frame_rect.y, frame_rect.width, frame_rect.height, app_id, window_index),
163-
-1, out stmt
164-
);
165-
166-
if (rc == Sqlite.OK) {
167-
rc = stmt.step ();
168-
if (rc == Sqlite.DONE) {
169-
return;
170-
}
189+
const string UPDATE_QUERY = "UPDATE apps SET last_x = $last_x, last_y = $last_y, last_width = $last_width, last_height = $last_height WHERE app_id = $app_id AND window_index = $window_index;";
190+
var rc = db.prepare_v2 (UPDATE_QUERY, UPDATE_QUERY.length, out stmt);
191+
if (rc != Sqlite.OK) {
192+
critical ("Cannot update app position in database: %d, %s", rc, db.errmsg ());
193+
return;
171194
}
172195

173-
critical ("Cannot update app position in database: %d, %s", rc, db.errmsg ());
196+
stmt.bind_text (stmt.bind_parameter_index ("$app_id"), app_id);
197+
stmt.bind_int (stmt.bind_parameter_index ("$window_index"), window_index);
198+
stmt.bind_int (stmt.bind_parameter_index ("$last_x"), frame_rect.x);
199+
stmt.bind_int (stmt.bind_parameter_index ("$last_y"), frame_rect.y);
200+
stmt.bind_int (stmt.bind_parameter_index ("$last_width"), frame_rect.width);
201+
stmt.bind_int (stmt.bind_parameter_index ("$last_height"), frame_rect.height);
202+
203+
rc = stmt.step ();
204+
if (rc != Sqlite.DONE) {
205+
critical ("Cannot update app position in database: %d, %s", rc, db.errmsg ());
206+
return;
207+
}
174208
}
175209

176210
private static void save_all_windows_state () {

0 commit comments

Comments
 (0)