From 3e1cd797886b5bdc255423b7d345a63e59d48ec9 Mon Sep 17 00:00:00 2001 From: CHOMPStation2 <58959929+CHOMPStation2@users.noreply.github.com> Date: Sun, 13 Aug 2023 13:30:42 -0700 Subject: [PATCH] [MIRROR] SQL Injection Fix (#6789) Co-authored-by: Casey Co-authored-by: CHOMPStation2 --- code/modules/admin/IsBanned.dm | 5 ++--- code/modules/vchat/vchat_client.dm | 6 ++++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/code/modules/admin/IsBanned.dm b/code/modules/admin/IsBanned.dm index f4884804f0..4eea2097ed 100644 --- a/code/modules/admin/IsBanned.dm +++ b/code/modules/admin/IsBanned.dm @@ -46,11 +46,11 @@ var/cidquery = "" if(address) failedip = 0 - ipquery = " OR ip = '[address]' " + ipquery = " OR ip = '[sanitizeSQL(address)]' " if(computer_id) failedcid = 0 - cidquery = " OR computerid = '[computer_id]' " + cidquery = " OR computerid = '[sanitizeSQL(computer_id)]' " var/DBQuery/query = SSdbcore.NewQuery("SELECT ckey, ip, computerid, a_ckey, reason, expiration_time, duration, bantime, bantype FROM erro_ban WHERE (ckey = :t_ckey [ipquery] [cidquery]) AND (bantype = 'PERMABAN' OR (bantype = 'TEMPBAN' AND expiration_time > Now())) AND isnull(unbanned)", list("t_ckey" = ckeytext)) //CHOMPEdit TGSQL @@ -81,4 +81,3 @@ message_admins("[key] has logged in with a blank ip in the ban check.") return ..() //default pager ban stuff #endif - diff --git a/code/modules/vchat/vchat_client.dm b/code/modules/vchat/vchat_client.dm index 3ef89ec260..76543c7cf8 100644 --- a/code/modules/vchat/vchat_client.dm +++ b/code/modules/vchat/vchat_client.dm @@ -263,6 +263,12 @@ GLOBAL_DATUM_INIT(iconCache, /savefile, new("data/iconCache.sav")) //Cache of ic if(!cid && !ip && !ckey) return + if(cid && !isnum(cid) && !(cid == "")) + log_and_message_admins("[key_name(owner)] - bancheck with invalid cid! ([cid])") + + if(ip && !findtext(ip, new/regex("^((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$")) && !(ip == "")) + log_and_message_admins("[key_name(owner)] - bancheck with invalid ip! ([ip])") + var/list/ban = world.IsBanned(key = ckey, address = ip, computer_id = cid) if(ban) log_and_message_admins("[key_name(owner)] has a cookie from a banned account! (Cookie: [ckey], [ip], [cid])")