check column name pattern

This commit is contained in:
Daniel Gultsch 2023-08-18 09:01:46 +02:00
parent 09f6343ced
commit 459d559a34
No known key found for this signature in database
GPG key ID: F43D18AD2A0982C2

View file

@ -50,6 +50,7 @@ import java.util.List;
import java.util.Set; import java.util.Set;
import java.util.WeakHashMap; import java.util.WeakHashMap;
import java.util.concurrent.atomic.AtomicBoolean; import java.util.concurrent.atomic.AtomicBoolean;
import java.util.regex.Pattern;
import java.util.zip.GZIPInputStream; import java.util.zip.GZIPInputStream;
import java.util.zip.ZipException; import java.util.zip.ZipException;
@ -89,6 +90,8 @@ public class ImportBackupService extends Service {
SQLiteAxolotlStore.SIGNED_PREKEY_TABLENAME, SQLiteAxolotlStore.SIGNED_PREKEY_TABLENAME,
SQLiteAxolotlStore.SESSION_TABLENAME, SQLiteAxolotlStore.SESSION_TABLENAME,
SQLiteAxolotlStore.IDENTITIES_TABLENAME); SQLiteAxolotlStore.IDENTITIES_TABLENAME);
private static final Pattern COLUMN_PATTERN = Pattern.compile("^[a-zA-Z_]+$");
@Override @Override
public void onCreate() { public void onCreate() {
@ -364,13 +367,17 @@ public class ImportBackupService extends Service {
jsonReader.beginObject(); jsonReader.beginObject();
while (jsonReader.peek() != JsonToken.END_OBJECT) { while (jsonReader.peek() != JsonToken.END_OBJECT) {
final String name = jsonReader.nextName(); final String name = jsonReader.nextName();
if (jsonReader.peek() == JsonToken.NULL) { if (COLUMN_PATTERN.matcher(name).matches()) {
jsonReader.nextNull(); if (jsonReader.peek() == JsonToken.NULL) {
contentValues.putNull(name); jsonReader.nextNull();
} else if (jsonReader.peek() == JsonToken.NUMBER) { contentValues.putNull(name);
contentValues.put(name, jsonReader.nextLong()); } else if (jsonReader.peek() == JsonToken.NUMBER) {
contentValues.put(name, jsonReader.nextLong());
} else {
contentValues.put(name, jsonReader.nextString());
}
} else { } else {
contentValues.put(name, jsonReader.nextString()); throw new IOException(String.format("Unexpected column name %s", name));
} }
} }
jsonReader.endObject(); jsonReader.endObject();