Part of the EllisLab Network
   
2 of 3
2
Vulnerable bug in CodeIgniter which took us hours to fix our corrupted database
Posted: 18 April 2007 04:03 PM   [ Ignore ]   [ # 16 ]  
Grad Student
Avatar
Rank
Total Posts:  71
Joined  10-03-2006

why would you make a commercial site without doing simple data check… that’s just rude!

 Signature 

Stupid people do stupid things, smart people outsmart each otherSOAD

Profile
 
 
Posted: 18 April 2007 06:08 PM   [ Ignore ]   [ # 17 ]  
Research Assistant
RankRankRank
Total Posts:  549
Joined  06-17-2006

At first I agreed with the view that this was a bug. But I’ve changed my mind now.

My reason for this is the text on active record page on the CI user manual.

2 Custom key/value method:

You can include an operator in the first parameter in order to control the comparison:
$this->db->where(‘name !=’, $name);
$this->db->where(‘id <’, $id);

// Produces: WHERE name != ‘Joe’ AND id < 45

However, I feel for Hasin and support the view that extra care needs to be taken to sift out special cases (here, where the value is null). Testing or no testing, the potential to do damage is great here and Hasin’s experience has shown this. You could flog Hasin for not testing - the same arguements could just as easily be applied to the function authors.

 Signature 

CodeCrafter - Open Source Code Generation for CI

Profile
 
 
Posted: 18 April 2007 06:29 PM   [ Ignore ]   [ # 18 ]  
Research Assistant
Avatar
RankRankRank
Total Posts:  351
Joined  07-25-2006

I agree that this is a bug, but the fact that it hit you is your fault. You are supposed to check to make sure that the data you are entering is valid, at all times.

 Signature 

me and some random code, hosted by dh. and a blog too! ++ dead bugs

Profile
 
 
Posted: 18 April 2007 06:31 PM   [ Ignore ]   [ # 19 ]  
Summer Student
Total Posts:  8
Joined  04-16-2007

^ what he said

Profile
 
 
Posted: 18 April 2007 06:45 PM   [ Ignore ]   [ # 20 ]  
Lab Technician
Avatar
RankRankRankRank
Total Posts:  1735
Joined  06-23-2006

We’re gonna scare the poor fellow off. I think he gets the point. smile

I’ve asked Derek for how we can proceed with getting these fixes made quickly. A quick turnaround time could be another edge for CodeIgniter.

 Signature 

Mac OS X 10.4.10, Apache 1.3.3, PHP 5.2.3, CodeIgniter 1.5.x., baby!

Profile
 
 
Posted: 18 April 2007 07:49 PM   [ Ignore ]   [ # 21 ]  
Lab Technician
Avatar
RankRankRankRank
Total Posts:  1735
Joined  06-23-2006

(official version v1.5.3—not fixed)

function _where($key, $value = NULL, $type = 'AND ')
{
    
if ( ! is_array($key))
    
{
        $key
= array($key => $value);
    
}
    
    
foreach ($key as $k => $v)
    
{
        $prefix
= (count($this->ar_where) == 0) ? '' : $type;
        
        if ( !
is_null($v))
        
{
            
if ( ! $this->_has_operator($k))
            
{
                $k
.= ' =';
            
}
        
            $v
= ' '.$this->escape($v);
        
}
                    
        $this
->ar_where[] = $prefix.$k.$v;
    
}
    
return $this;
}

I actually challenge the design of this function. NULL is a valid value for a database column, but this code is concatenating together the $k and the $v to form (part of) the WHERE condition. It’s painfully clear how the problem described in this thread can be introduced, by the very design of the function’s prototype (with $value defaulting to NULL). The SQL version of “null” is not gracefully converted from the PHP version, but I think it should.

Query: “Find all products where price is not yet set”

SELECT * FROM products WHERE price IS NULL

I don’t use SQL directly anymore, as my database layer writes it for, so how does one create the WHERE condition of “price IS NULL”?

Like this?

$this->db->where('price', 'IS NULL');

I would prefer smarter handling and auto-conversion from the PHP NULL value:

$this->db->where('price', NULL);

I’m sure the db experts out there have something to say about that, so chime into this exciting thread of discussion. smile

 Signature 

Mac OS X 10.4.10, Apache 1.3.3, PHP 5.2.3, CodeIgniter 1.5.x., baby!

Profile
 
 
Posted: 19 April 2007 01:21 AM   [ Ignore ]   [ # 22 ]  
Summer Student
Avatar
Total Posts:  25
Joined  03-05-2007

Thanks you guys! I know it is my fault not to check the value, but the result was simply horrible as it was not documented anywhere.

Thanks for your help out there.

Is anyone core dev out there? Can you please commit the solution into the trunk?

 Signature 

Regards
Hasin Hayder
Zend Certified Engineer
Pageflakes Limited

See my blog at http://hasin.wordpress.com

Profile
 
 
Posted: 19 April 2007 08:23 AM   [ Ignore ]   [ # 23 ]  
Lab Assistant
Avatar
RankRank
Total Posts:  197
Joined  04-18-2006
coolfactor - 18 April 2007 07:49 PM

I would prefer smarter handling and auto-conversion from the PHP NULL value:

$this->db->where('price', NULL);

That won’t work, that requires a PHP constant called NULL.

This already works fine:

$this->db->where('price IS NULL');
$this->db->where('price IS NOT NULL');

If active record needs to handle NULL values, I think a new method would be necessary (?):

$this->db->wherenull('price');

In SQL, handling of NULL values is always a special case because of the non-quoted syntax.

 Signature 

http://www.motortopia.com/
http://www.phpinsider.com/

Profile
 
 
Posted: 19 April 2007 09:55 AM   [ Ignore ]   [ # 24 ]  
Summer Student
Avatar
Total Posts:  25
Joined  03-05-2007

edited

 Signature 

Regards
Hasin Hayder
Zend Certified Engineer
Pageflakes Limited

See my blog at http://hasin.wordpress.com

Profile
 
 
Posted: 19 April 2007 10:04 AM   [ Ignore ]   [ # 25 ]  
Lab Assistant
RankRank
Total Posts:  128
Joined  04-06-2007

Dude, I was behind you all the way until you started pumping bad press all over the place.  Get a grip.  mad  You found a bug, you reported it, the code is being worked on.  No need to blab all over the word about your “bad experience” with CI.  Especially when the problem was partially yours for not checking your data.  Methinks your ego must be gigantic.

Profile
 
 
Posted: 19 April 2007 10:14 AM   [ Ignore ]   [ # 26 ]  
Summer Student
Avatar
Total Posts:  25
Joined  03-05-2007

Sorry mate, you get me wrong. I am a big CI fan. I just posted it in my blog.

You can also check here http://www.ohloh.net/projects/4692, thats me. I promoted CI as best as I can.

 Signature 

Regards
Hasin Hayder
Zend Certified Engineer
Pageflakes Limited

See my blog at http://hasin.wordpress.com

Profile
 
 
Posted: 19 April 2007 10:24 AM   [ Ignore ]   [ # 27 ]  
Lab Assistant
RankRank
Total Posts:  128
Joined  04-06-2007
Hasin - 19 April 2007 10:14 AM

Sorry mate, you get me wrong. I am a big CI fan. I just posted it in my blog.

You can also check here http://www.ohloh.net/projects/4692, thats me. I promoted CI as best as I can.

I understand what you’re saying, but according to one of the articles you had linked before, you also emailed PHP Community Magazine the blog post contents.

And while I respect the removing of the article links from the post I was responding to, there is still some unbalanced bad press out there regarding CI now.

Now I am real new to CI and have nothing to lose in EllisLab or CI taking some bad press.  But the thing is, I think CI is amazing and doesn’t deserve to have people looking at it badly based on what these PHP sites are now reporting.

Jim

Profile
 
 
Posted: 19 April 2007 11:38 AM   [ Ignore ]   [ # 28 ]  
Lab Technician
Avatar
RankRankRankRank
Total Posts:  1735
Joined  06-23-2006
mohrt - 19 April 2007 08:23 AM
coolfactor - 18 April 2007 07:49 PM

I would prefer smarter handling and auto-conversion from the PHP NULL value:

$this->db->where('price', NULL);

That won’t work, that requires a PHP constant called NULL.

 

Yes, and there’s no reason that the Active Record class can’t transmute from PHP’s NULL value to SQL’s NULL value. The Active Record class is about creating semantically-correct queries and abstracting the underlying language as much as possible, no?

 Signature 

Mac OS X 10.4.10, Apache 1.3.3, PHP 5.2.3, CodeIgniter 1.5.x., baby!

Profile
 
 
Posted: 19 April 2007 11:57 AM   [ Ignore ]   [ # 29 ]  
Lab Assistant
Avatar
RankRank
Total Posts:  197
Joined  04-18-2006
coolfactor - 19 April 2007 11:38 AM

Yes, and there’s no reason that the Active Record class can’t transmute from PHP’s NULL value to SQL’s NULL value. The Active Record class is about creating semantically-correct queries and abstracting the underlying language as much as possible, no?

Umm, ya know the brain is in neutral this morning, I was thinking there was not necessarily a NULL PHP constant, but of course there is. smile So yeah, if null is passed, the active record should treat is as such.

 Signature 

http://www.motortopia.com/
http://www.phpinsider.com/

Profile
 
 
Posted: 19 April 2007 12:05 PM   [ Ignore ]   [ # 30 ]  
Lab Assistant
RankRank
Total Posts:  128
Joined  04-06-2007
mohrt - 19 April 2007 11:57 AM
coolfactor - 19 April 2007 11:38 AM

Yes, and there’s no reason that the Active Record class can’t transmute from PHP’s NULL value to SQL’s NULL value. The Active Record class is about creating semantically-correct queries and abstracting the underlying language as much as possible, no?

Umm, ya know the brain is in neutral this morning, I was thinking there was not necessarily a NULL PHP constant, but of course there is. smile So yeah, if null is passed, the active record should treat is as such.

I was a wunderin’ what you was a talkin’ ‘bout!  wink
Profile
 
 
   
2 of 3
2
 
Post Marker Legend
New Topic New posts Hot Topic Hot Topic with new posts New Poll New Poll Moved Topic Moved Topic Sticky Topic Sticky topic
Old Topic No new posts Hot Old Topic Hot Topic with no new posts Old Poll Old Poll Closed Topic Closed Topic Announcement Announcements
Theme
Change Theme
Visitor Statistics
The most visitors ever was 719, on June 06, 2008 10:16 AM
Total Registered Members: 62793 Total Logged-in Users: 17
Total Topics: 77476 Total Anonymous Users: 1
Total Replies: 418198 Total Guests: 149
Total Posts: 495674    
Members ( View Memberlist )
Newest Members:  markrichesongerdyPorscheescapeexpyAnn BaileyTy BexDamien2k8cibbuserphilcalvin