...
The outer parentheses of the malicious search string defeat the grouping protection. Using the OR operator allows injection of any arbitrary regex. Now this use will reveal all times and IPs the keyword 'C' was searched.
| Code Block | ||
|---|---|---|
| ||
package edu.cmu.cs392.p3.log;
import java.util.HashSet;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class ExploitableLog
{
   //A buffer containing the log.
   private StringBuffer logBuffer;
  Â
   /* an application repeatedly calls this function that searches through the
   * search log for search suggestions for autocompletion
   */
   public Set<String> suggestSearches(String search)
   {
      Set<String> searches = new HashSet<String>();
     Â
      /* Construct regex from user string */
      //Regex matches full valid log lines. The grouping characters will limit
      //the returned string to only the keyword.
      String regex = "^(" + search + ".*),[0-9]+?,[0-9]+?$";
      int flags = Pattern.MULTILINE; //needed since matching on a String
                              //containing newlines
      Pattern p = Pattern.compile(regex, flags);
     Â
      /* Read from log */
      int len = logBuffer.length(); //the SB can only be >= to this number
      String s = logBuffer.substring(0, len);
      logBuffer.delete(0, len);
     Â
      /* Match regex */
      Matcher m = p.matcher(s);
      while (m.find()) {
         String found = m.group(1);
         searches.add(found);
      }
     Â
      return searches;
   }
  Â
   public ExploitableLog()
   {
      //this is supposed to come from a file, but its here as a string for
      //illustrative purposes
      logBuffer = new StringBuffer();
      logBuffer.append("Alice,1267773881,2147651408\n");
      logBuffer.append("Bono,1267774881,2147351708\n");
      logBuffer.append("Charles,1267775881,1175523058\n");
      logBuffer.append("Cecilia,1267773222,291232332\n");
   }
}
|
...
This solution filters out non-alphanumeric characters from the search string using Java's Character.isLetterOrDigit(). This removes the grouping parentheses and the OR operator which triggers the injection.
| Code Block | ||
|---|---|---|
| ||
package edu.cmu.cs392.p3.log;
import java.util.HashSet;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class FilteredLog
{
   //A buffer containing the log.
   private StringBuffer logBuffer;
  Â
   /* an application repeatedly calls this function that searches through the
   * search log for search suggestions for autocompletion
   */
   public Set<String> suggestSearches(String search)
   {
      Set<String> searches = new HashSet<String>();
     Â
      /* Filter user input */
      StringBuilder sb = new StringBuilder(search.length());
      for (int i = 0; i < search.length(); ++i) {
         char ch = search.charAt(i);
         if (Character.isLetterOrDigit(ch))
            sb.append(ch);
      }
      search = sb.toString();
     Â
      /* Construct regex from user string */
      //Regex matches full valid log lines. The grouping characters will limit
      //the returned string to only the keyword.
      String regex = "^(" + search + ".*),[0-9]+?,[0-9]+?$";
      int flags = Pattern.MULTILINE; //needed since matching on a String
                              //containing newlines
      Pattern p = Pattern.compile(regex, flags);
     Â
      /* Read from log */
      int len = logBuffer.length(); //the SB can only be >= to this number
      String s = logBuffer.substring(0, len);
      logBuffer.delete(0, len);
     Â
      /* Match regex */
      Matcher m = p.matcher(s);
      while (m.find()) {
         String found = m.group(1);
         searches.add(found);
      }
     Â
      return searches;
   }
  Â
   public FilteredLog()
   {
      //this is supposed to come from a file, but its here as a string for
      //illustrative purposes
      logBuffer = new StringBuffer();
      logBuffer.append("Alice,1267773881,2147651408\n");
      logBuffer.append("Bono,1267774881,2147351708\n");
      logBuffer.append("Charles,1267775881,1175523058\n");
      logBuffer.append("Cecilia,1267773222,291232332\n");
   }
}
|
...