mirror of
https://github.com/hohn/codeql-dataflow-sql-injection.git
synced 2025-12-16 02:03:05 +01:00
Add simple logging
This commit is contained in:
committed by
=Michael Hohn
parent
5210f57197
commit
41dd5e004e
@@ -6,12 +6,16 @@
|
|||||||
./admin create-db
|
./admin create-db
|
||||||
./admin show-db
|
./admin show-db
|
||||||
|
|
||||||
|
# Add regular user interactively
|
||||||
|
./add-user 2>> users.log
|
||||||
|
./admin show-db
|
||||||
|
|
||||||
# Regular user
|
# Regular user
|
||||||
echo "sample user" | ./add-user
|
echo "sample user" | ./add-user 2>> users.log
|
||||||
./admin show-db
|
./admin show-db
|
||||||
|
|
||||||
# Johnny Droptable
|
# Johnny Droptable
|
||||||
echo "Johnny'); DROP TABLE users; -- " | ./add-user
|
echo "Johnny'); DROP TABLE users; -- " | ./add-user 2>> users.log
|
||||||
|
|
||||||
./admin show-db
|
./admin show-db
|
||||||
|
|
||||||
|
|||||||
19
add-user.c
19
add-user.c
@@ -3,6 +3,22 @@
|
|||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
#include <ctype.h>
|
#include <ctype.h>
|
||||||
#include <sqlite3.h>
|
#include <sqlite3.h>
|
||||||
|
#include <time.h>
|
||||||
|
|
||||||
|
void write_log(const char* fmt, ...) {
|
||||||
|
time_t t;
|
||||||
|
char tstr[26];
|
||||||
|
va_list args;
|
||||||
|
|
||||||
|
va_start(args, fmt);
|
||||||
|
t = time(NULL);
|
||||||
|
ctime_r(&t, tstr);
|
||||||
|
tstr[24] = 0; /* no \n */
|
||||||
|
fprintf(stderr, "[%s] ", tstr);
|
||||||
|
vfprintf(stderr, fmt, args);
|
||||||
|
va_end(args);
|
||||||
|
fflush(stderr);
|
||||||
|
}
|
||||||
|
|
||||||
void abort_on_error(int rc, sqlite3 *db) {
|
void abort_on_error(int rc, sqlite3 *db) {
|
||||||
if( rc ) {
|
if( rc ) {
|
||||||
@@ -59,8 +75,7 @@ void write_info(int id, char* info) {
|
|||||||
|
|
||||||
/* Format query */
|
/* Format query */
|
||||||
snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info);
|
snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info);
|
||||||
printf("%s\n", query);
|
write_log("query: %s\n", query);
|
||||||
fflush(stdout);
|
|
||||||
|
|
||||||
/* Write info */
|
/* Write info */
|
||||||
rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);
|
rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);
|
||||||
|
|||||||
Reference in New Issue
Block a user