From 981c6cf5442bfb16c177f995deedeb3ec44bf5fb Mon Sep 17 00:00:00 2001 From: "Olivier Wilkinson (reivilibre)" Date: Tue, 20 Aug 2019 15:41:10 +0100 Subject: Sanitise accepted fields in `_update_stats_delta_txn` Signed-off-by: Olivier Wilkinson (reivilibre) --- synapse/storage/stats.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/synapse/storage/stats.py b/synapse/storage/stats.py index 0445b97b4a..a372f35eae 100644 --- a/synapse/storage/stats.py +++ b/synapse/storage/stats.py @@ -15,6 +15,7 @@ # limitations under the License. import logging +from itertools import chain from twisted.internet import defer @@ -160,6 +161,17 @@ class StatsStore(StateDeltasStore): quantised_ts = self.quantise_stats_time(int(ts)) end_ts = quantised_ts + self.stats_bucket_size + for field in chain(fields.keys(), absolute_fields.keys()): + if ( + field not in ABSOLUTE_STATS_FIELDS[stats_type] + and field not in PER_SLICE_FIELDS[stats_type] + ): + # guard against potential SQL injection dodginess + raise ValueError( + "%s is not a recognised field" + " for stats type %s" % (field, stats_type) + ) + field_sqls = ["%s = %s + ?" % (field, field) for field in fields.keys()] field_values = list(fields.values()) -- cgit 1.5.1