check column name pattern

This commit is contained in:
Daniel Gultsch 2023-08-18 09:01:46 +02:00
parent 09f6343ced
commit 459d559a34
No known key found for this signature in database
GPG key ID: F43D18AD2A0982C2

View file

@ -50,6 +50,7 @@ import java.util.List;
import java.util.Set;
import java.util.WeakHashMap;
import java.util.concurrent.atomic.AtomicBoolean;
import java.util.regex.Pattern;
import java.util.zip.GZIPInputStream;
import java.util.zip.ZipException;
@ -89,6 +90,8 @@ public class ImportBackupService extends Service {
SQLiteAxolotlStore.SIGNED_PREKEY_TABLENAME,
SQLiteAxolotlStore.SESSION_TABLENAME,
SQLiteAxolotlStore.IDENTITIES_TABLENAME);
private static final Pattern COLUMN_PATTERN = Pattern.compile("^[a-zA-Z_]+$");
@Override
public void onCreate() {
@ -364,6 +367,7 @@ public class ImportBackupService extends Service {
jsonReader.beginObject();
while (jsonReader.peek() != JsonToken.END_OBJECT) {
final String name = jsonReader.nextName();
if (COLUMN_PATTERN.matcher(name).matches()) {
if (jsonReader.peek() == JsonToken.NULL) {
jsonReader.nextNull();
contentValues.putNull(name);
@ -372,6 +376,9 @@ public class ImportBackupService extends Service {
} else {
contentValues.put(name, jsonReader.nextString());
}
} else {
throw new IOException(String.format("Unexpected column name %s", name));
}
}
jsonReader.endObject();
jsonReader.endObject();