...
This program searches a database of users for searches that match a regular expressions to present search suggestions to the user.
| No Format |
|---|
A non-malicious use would be to enter "Bono". A malicious use would be to enter "?:)(^Bono,[0-9]+?,[0-9]+?$)|(?:". |
The
...
outer
...
parentheses
...
defeat
...
the
...
grouping
...
protection.
...
Now
...
this
...
use
...
will
...
reveal
...
all
...
times
...
and
...
IPs
...
the
...
keyword
...
'Bono'
...
was
...
searched.
...
Using
...
the
...
OR
...
operator
...
allows
...
injection
...
of
...
any
...
arbitrary
...
regex.
...
| Code Block | ||
|---|---|---|
| ||
/* Say this logfile contains:
 * CSV style: search string, time (unix), ip (integer)
 *
 * Alice,1267773881,2147651708
 * Bono,1267774881,2147651708
 * Charles,1267775881,1175563058
 *
 * and the CSVLog class has a readLine() method which retrieves a single line from the CSVLog and returns null when at EOF
 */
private CSVLog logfile;
Â
//an application repeatedly calls this function that searches through the search log for search suggestions for autocompletion
public Set<String> suggestSearches(String search)
{
  Set<String> searches = new HashSet<String>();
  Â
  //construct regex from user's string //the regex matches valid lines and the grouping characters will limit the returned regex to the search string
  String regex = "^(" + search + "),[0-9]+?,[0-9]+?$";
  Pattern p = Pattern.compile(regex);
  String s;
  while ((s = logfile.readLine()) != null) { //gets a single line from the logfile
      Matcher m = p.matcher(s);
      if (m.find()) {
          String found = m.group(1);
          searches.add(found);
      }
  }
      Â
  return searches;
}
|
...