Bug Report: SQL injection in dbop3_get

--0000000000001f1a960641b2bfec
Content-Type: text/plain; charset="UTF-8"

In libutil/dbop.c, dbop_get calls dbop3_get when using the sqlite3 backend.
dbop3_get prepares a sqlite3 query is prepared as follows:

 strbuf_sprintf(sql, "select dat, extra from %s where key = '%s' limit
1", dbop->tblname, name);

If the `name` character contains a single-quote character, a SQL injection
can occur.

dbop_get can be called with unsanitized values, e.g. raw path strings when
inserting paths into GPATH.

As a result, running gtags in sqlite3 mode on a source tree containing a
path with a single-quote may fail or execute unintended sql queries.

A fix may involve using a prepared statement, or properly sql-escaping the
`name` parameter.

Note: this bug was found by Theori's Xint Code analysis.

Thanks,
Tim Becker
Theori

--0000000000001f1a960641b2bfec
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">In libutil/dbop.c, dbop_get calls dbop3_get when using the=
 sqlite3 backend. dbop3_get prepares a sqlite3 query is prepared as follows=
:<br><br>=C2=A0strbuf_sprintf(sql, &quot;select dat, extra from %s where ke=
y =3D &#39;%s&#39; limit 1&quot;,=C2=A0dbop-&gt;tblname, name);=C2=A0<br><b=
r>If the `name` character contains a single-quote character, a SQL injectio=
n can occur.<br><br>dbop_get can be called with unsanitized values, e.g. ra=
w path strings when inserting paths into GPATH.<br><br>As a result, running=
 gtags in sqlite3 mode on a source tree containing a path with a single-quo=
te may fail or execute unintended sql queries.<br><br>A fix may involve=C2=
=A0using a prepared statement, or properly sql-escaping the `name` paramete=
r.<br><br>Note: this bug was found by Theori&#39;s Xint Code analysis.<br><=
br>Thanks,<br>Tim Becker<br>Theori</div>

--0000000000001f1a960641b2bfec--