GTFS Schedule stop lookup: escape HaltID 🐛✅🔒

lib/gtfs-stop-by-aus-haltid.js

@@ -1,3 +1,4 @@
+import {strictEqual} from 'node:assert/strict'
 import QuickLRU from 'quick-lru'
 import {connectToPostgres} from './db.js'
 
@@ -9,6 +10,20 @@ const stripDataProviderPrefixFromAusHaltID = (ausHaltId) => {
  : ausHaltId
 }
 
+// > If pattern does not contain percent signs or underscore, then the pattern only represents the string itself; in that case LIKE acts like the equals operator. An underscore (_) in pattern stands for (matches) any single character; a percent sign (%) matches any string of zero or more characters.
+// > To match a literal underscore or percent sign without matching other characters, the respective character in pattern must be preceded by the escape character. […]
+// > https://www.postgresql.org/docs/7.3/functions-matching.html
+const escapeForLikeOp = (input) => {
+ return input
+ .replaceAll('\\', '\\\\')
+ .replaceAll('%', '\\%')
+ .replaceAll('_', '\\_')
+}
+strictEqual(
+ escapeForLikeOp('foo\\bar\\\\baz%hey_there'),
+ 'foo\\\\bar\\\\\\\\baz\\%hey\\_there',
+)
+
 const createQueryGtfsStopByAusHaltID = async (cfg, opt = {}) => {
  const {
  logger,
@@ -46,7 +61,7 @@ LIMIT 2
  // By requiring stop IDs to end with the (stripped) HaltID (e.g. `de:12063:900210771` "Rathenow, Bahnhof"), effectively we only obtain stations (stops witout parent).
  // [0] https://en.wikipedia.org/wiki/Identification_of_Fixed_Objects_in_Public_Transport
  // [1] https://www.delfi.de/de/strategie-technik/architektur/
- '%:' + strippedHaltId,
+ `%:${escapeForLikeOp(strippedHaltId)}`,
  ],
  })
 

test/gtfs-stop-by-aus-haltid.js

@@ -0,0 +1,22 @@
+import {test, after} from 'node:test'
+import {deepStrictEqual} from 'node:assert'
+import {createLogger} from '../lib/logger.js'
+import {createQueryGtfsStopByAusHaltID} from '../lib/gtfs-stop-by-aus-haltid.js'
+
+const {
+ uncachedQueryGtfsStopByAusHaltID: queryGtfsStopByAusHaltID,
+ stop,
+} = await createQueryGtfsStopByAusHaltID({
+ logger: createLogger('gtfs-stop-by-aus-haltid-test', {
+ level: 'fatal',
+ })
+})
+after(async () => {
+ await stop()
+})
+
+test('does not allow `%` SQL injections', async (t) => {
+ // There is only one stop with a stop_id matching `%:90044994%`, so if we insert `90044994%` unescaped into a `LIKE '%' || $1` query, we obtain a non-ambiguous result through injection.
+ const stop = await queryGtfsStopByAusHaltID('90044994%')
+ deepStrictEqual(stop, null, 'must not return a stop')
+})

test/index.sh

@@ -31,5 +31,6 @@ NODE_ENV=production build-gtfs-match-index \
 
 # ---
 
+node gtfs-stop-by-aus-haltid.js
 node vdv-aus-istfahrt-as-fptf-trip.js
 node fptf-trip-as-gtfs-rt-tripupdate.js