diff options
| author | ILYA Khlopotov <iilyak@apache.org> | 2018-10-08 04:11:52 -0700 |
|---|---|---|
| committer | ILYA Khlopotov <iilyak@apache.org> | 2018-10-10 09:57:35 -0700 |
| commit | aa63804c3b3fc4b637d7095f5ff993ff2d01818e (patch) | |
| tree | 8f14e02414c98581f15e9020081cca42b02773c7 | |
| parent | be6de6f32d0be7147dce8ebe39dd54c07d7be31f (diff) | |
| download | couchdb-aa63804c3b3fc4b637d7095f5ff993ff2d01818e.tar.gz | |
Validate database prefix against DBNAME_REGEX for system dbs
Previously we only checked that the suffix of the database is
matching one of the predefined system databases. We really should
check the prefix against DBNAME_REGEXP to prevent creation of
illegally named databases.
This fixes #1644
| -rw-r--r-- | src/couch/src/couch_db.erl | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/src/couch/src/couch_db.erl b/src/couch/src/couch_db.erl index 55664e964..4d76ceedc 100644 --- a/src/couch/src/couch_db.erl +++ b/src/couch/src/couch_db.erl @@ -1738,8 +1738,15 @@ validate_dbname_int(DbName, Normalized) when is_binary(DbName) -> is_systemdb(DbName) when is_list(DbName) -> is_systemdb(?l2b(DbName)); is_systemdb(DbName) when is_binary(DbName) -> - lists:member(dbname_suffix(DbName), ?SYSTEM_DATABASES). - + Normalized = normalize_dbname(DbName), + Suffix = filename:basename(Normalized), + case {filename:dirname(Normalized), lists:member(Suffix, ?SYSTEM_DATABASES)} of + {<<".">>, Result} -> Result; + {Prefix, false} -> false; + {Prefix, true} -> + ReOpts = [{capture,none}, dollar_endonly], + re:run(Prefix, ?DBNAME_REGEX, ReOpts) == match + end. set_design_doc_keys(Options1) -> Dir = case lists:keyfind(dir, 1, Options1) of @@ -1831,7 +1838,9 @@ validate_dbname_fail_test_() -> Cases = generate_cases("_long/co$mplex-/path+/_something") ++ generate_cases("_something") ++ generate_cases_with_shards("long/co$mplex-/path+/_something#") - ++ generate_cases_with_shards("long/co$mplex-/path+/some.thing"), + ++ generate_cases_with_shards("long/co$mplex-/path+/some.thing") + ++ generate_cases("!abcdefg/werwej/_users") + ++ generate_cases_with_shards("!abcdefg/werwej/_users"), { foreach, fun setup/0, fun teardown/1, [should_fail_validate_dbname(A) || {_, A} <- Cases] |