fix: validate search field names against mapping allowlist

Prevent authenticated SQL injection in call-data search by rejecting
unsanitised field identifiers before they are concatenated into WHERE
clauses. Bump version to 1.5.16.

Author: adubovikov

data/service/search.go

@@ -122,6 +122,7 @@ func buildQuery(elems []interface{}, orLogic bool, mappingJSON json.RawMessage,
 	sLimit = 200
 
 	smartMap := make(map[string]model.MappingSmart)
+	fieldAllowlist := buildSearchFieldAllowlist(mappingJSON)
 
 	firsLoop := true
 
@@ -132,6 +133,11 @@ func buildQuery(elems []interface{}, orLogic bool, mappingJSON json.RawMessage,
 			formName := mapData["name"].(string)
 			formType := mapData["type"].(string)
 
+			if formName != "smartinput" && formName != "limit" && !validateSearchFieldName(formName, fieldAllowlist) {
+				logger.Error("Rejected search field name: ", formName)
+				continue
+			}
+
 			//We should be sure  that this is value string
 			switch x := formVal.(type) {
 			case string:
@@ -185,6 +191,11 @@ func buildQuery(elems []interface{}, orLogic bool, mappingJSON json.RawMessage,
 						typeValue = modSmart.Type
 					}
 
+					if !validateSearchFieldName(operandField, fieldAllowlist) {
+						logger.Error("Rejected smartinput field name: ", operandField)
+						continue
+					}
+
 					if strings.Contains(operandField, ".") {
 						elemArray := strings.Split(operandField, ".")
 						if typeValue == "integer" {

data/service/search_query_security.go

@@ -0,0 +1,75 @@
+package service
+
+import (
+	"encoding/json"
+	"regexp"
+	"strings"
+
+	"github.com/Jeffail/gabs/v2"
+	"github.com/sipcapture/homer-app/utils/logger"
+)
+
+var (
+	searchJSONBColumns = map[string]struct{}{
+		"data_header":     {},
+		"protocol_header": {},
+	}
+
+	safeJSONKeyPattern = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*$`)
+)
+
+func buildSearchFieldAllowlist(mappingJSON json.RawMessage) map[string]struct{} {
+	allowlist := make(map[string]struct{})
+
+	for _, field := range []string{"limit", "smartinput", "raw", "id", "sid", "create_date"} {
+		allowlist[field] = struct{}{}
+	}
+
+	if len(mappingJSON) == 0 {
+		return allowlist
+	}
+
+	sMapping, err := gabs.ParseJSON(mappingJSON)
+	if err != nil {
+		logger.Error("buildSearchFieldAllowlist: invalid mapping JSON: ", err)
+		return allowlist
+	}
+
+	for _, val := range sMapping.Children() {
+		if !val.Exists("id") {
+			continue
+		}
+		id, ok := val.S("id").Data().(string)
+		if !ok || id == "" {
+			continue
+		}
+		allowlist[id] = struct{}{}
+	}
+
+	return allowlist
+}
+
+func validateSearchFieldName(formName string, allowlist map[string]struct{}) bool {
+	if formName == "" {
+		return false
+	}
+
+	if _, ok := allowlist[formName]; !ok {
+		return false
+	}
+
+	if !strings.Contains(formName, ".") {
+		return true
+	}
+
+	parts := strings.Split(formName, ".")
+	if len(parts) != 2 {
+		return false
+	}
+
+	if _, ok := searchJSONBColumns[parts[0]]; !ok {
+		return false
+	}
+
+	return safeJSONKeyPattern.MatchString(parts[1])
+}

data/service/search_query_security_test.go

@@ -0,0 +1,109 @@
+package service
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestValidateSearchFieldName_rejectsSQLInjection(t *testing.T) {
+	allowlist := buildSearchFieldAllowlist(json.RawMessage(`[
+		{"id":"data_header.callid","type":"string"},
+		{"id":"protocol_header.srcIp","type":"string"},
+		{"id":"sid","type":"string"},
+		{"id":"raw","type":"string"}
+	]`))
+
+	cases := []struct {
+		name  string
+		field string
+		want  bool
+	}{
+		{name: "allowed dotted field", field: "data_header.callid", want: true},
+		{name: "allowed column", field: "sid", want: true},
+		{name: "allowed raw", field: "raw", want: true},
+		{name: "injection in identifier", field: "1=1) OR (SELECT pg_sleep(5)) IN (", want: false},
+		{name: "unknown field", field: "evil_column", want: false},
+		{name: "jsonb escape attempt", field: "data_header.callid' OR 1=1--", want: false},
+		{name: "extra path segment", field: "data_header.callid.extra", want: false},
+		{name: "invalid jsonb column", field: "users.password", want: false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := validateSearchFieldName(tc.field, allowlist); got != tc.want {
+				t.Fatalf("validateSearchFieldName(%q) = %v, want %v", tc.field, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestBuildQuery_rejectsInjectedFieldName(t *testing.T) {
+	mappingJSON := json.RawMessage(`[
+		{"id":"data_header.callid","type":"string"},
+		{"id":"sid","type":"string"}
+	]`)
+
+	elems := []interface{}{
+		map[string]interface{}{
+			"name":  "1=1) OR (SELECT 1) IN (",
+			"value": "x",
+			"type":  "string",
+		},
+	}
+
+	sql, _, values := buildQuery(elems, false, mappingJSON, 0)
+	if sql != "" {
+		t.Fatalf("expected empty SQL for rejected field, got %q", sql)
+	}
+	if len(values) != 0 {
+		t.Fatalf("expected no bind values, got %v", values)
+	}
+}
+
+func TestBuildQuery_rejectsInjectedSmartinputField(t *testing.T) {
+	mappingJSON := json.RawMessage(`[
+		{"id":"data_header.callid","type":"string"}
+	]`)
+
+	elems := []interface{}{
+		map[string]interface{}{
+			"name":  "smartinput",
+			"value": "1=1) OR (SELECT 1) IN ( = x",
+			"type":  "string",
+		},
+	}
+
+	sql, _, values := buildQuery(elems, false, mappingJSON, 0)
+	if sql != "" {
+		t.Fatalf("expected empty SQL for rejected smartinput field, got %q", sql)
+	}
+	if len(values) != 0 {
+		t.Fatalf("expected no bind values, got %v", values)
+	}
+}
+
+func TestBuildQuery_allowsMappedField(t *testing.T) {
+	mappingJSON := json.RawMessage(`[
+		{"id":"data_header.callid","type":"string"}
+	]`)
+
+	elems := []interface{}{
+		map[string]interface{}{
+			"name":  "data_header.callid",
+			"value": "abc@example.com",
+			"type":  "string",
+		},
+	}
+
+	sql, _, values := buildQuery(elems, false, mappingJSON, 0)
+	if sql == "" {
+		t.Fatal("expected SQL fragment for allowed field")
+	}
+	if !strings.Contains(sql, "data_header->>'callid'") {
+		t.Fatalf("unexpected SQL: %q", sql)
+	}
+	if len(values) != 1 || values[0] != "abc@example.com" {
+		t.Fatalf("unexpected bind values: %v", values)
+	}
+}

version.go

@@ -1,7 +1,7 @@
 package main
 
 // VERSION 
-var VERSION_APPLICATION = "1.5.15"
+var VERSION_APPLICATION = "1.5.16"
 
 // NAME
 var NAME_APPLICATION = "homer-app"