Dionisio
33cfb0faef
- V-02: XSS via innerHTML in profile.js — wrap err.message in escapeHtml() - V-03: IDOR upload to other users' folders — add folder ownership check - V-04: IDOR create folders in other users' trees — add parent ownership check - V-06: Content-Disposition header injection — RFC 5987 percent-encoding - V-08: WebDAV MOVE/COPY destination without ownership — add assert_owner checks - V-09: .gitignore missing cert/key patterns — add *.pem, *.key, *.p12, etc. - V-11: Username accepts XSS payloads — restrict to [a-zA-Z0-9._-] - V-12: Minimal email validation — reject forbidden chars, require domain dot - V-13: admin_reset_password doesn't invalidate sessions — revoke all sessions - V-14: Rate limiting bypassable via X-Forwarded-For — gate behind OXICLOUD_TRUST_PROXY_HEADERS - V-15: Cookie Secure flag off by default — default to true (safe-by-default) - V-16: LIKE wildcard injection in searches — add like_escape() helper across 9 sites
54 lines
2.2 KiB
Rust
54 lines
2.2 KiB
Rust
mod address_book_pg_repository;
|
|
mod app_password_pg_repository;
|
|
mod calendar_event_pg_repository;
|
|
mod calendar_pg_repository;
|
|
mod contact_group_pg_repository;
|
|
mod contact_persistence_dto;
|
|
mod contact_pg_repository;
|
|
mod device_code_pg_repository;
|
|
mod favorites_pg_repository;
|
|
mod recent_items_pg_repository;
|
|
mod session_pg_repository;
|
|
mod settings_pg_repository;
|
|
mod share_pg_repository;
|
|
mod transaction_utils;
|
|
mod user_pg_repository;
|
|
|
|
// ── Blob-storage repositories ──
|
|
pub mod file_blob_read_repository;
|
|
pub mod file_blob_write_repository;
|
|
pub mod folder_db_repository;
|
|
pub mod trash_db_repository;
|
|
|
|
pub use address_book_pg_repository::AddressBookPgRepository;
|
|
pub use app_password_pg_repository::AppPasswordPgRepository;
|
|
pub use calendar_event_pg_repository::CalendarEventPgRepository;
|
|
pub use calendar_pg_repository::CalendarPgRepository;
|
|
pub use contact_group_pg_repository::ContactGroupPgRepository;
|
|
pub use contact_persistence_dto::*;
|
|
pub use contact_pg_repository::ContactPgRepository;
|
|
pub use device_code_pg_repository::DeviceCodePgRepository;
|
|
pub use favorites_pg_repository::FavoritesPgRepository;
|
|
pub use file_blob_read_repository::FileBlobReadRepository;
|
|
pub use file_blob_write_repository::FileBlobWriteRepository;
|
|
pub use folder_db_repository::FolderDbRepository;
|
|
pub use recent_items_pg_repository::RecentItemsPgRepository;
|
|
pub use session_pg_repository::SessionPgRepository;
|
|
pub use settings_pg_repository::SettingsPgRepository;
|
|
pub use share_pg_repository::SharePgRepository;
|
|
pub use trash_db_repository::TrashDbRepository;
|
|
pub use user_pg_repository::UserPgRepository;
|
|
|
|
// ── SQL helpers ─────────────────────────────────────────────────────────────
|
|
|
|
/// Escape SQL `LIKE` / `ILIKE` wildcard characters (`%` and `_`) in user
|
|
/// input and wrap the result in `%…%` for a contains-match.
|
|
///
|
|
/// Without this, a user searching for `100%` would match *every* row because
|
|
/// `%` is a wildcard in LIKE patterns.
|
|
#[inline]
|
|
pub fn like_escape(raw: &str) -> String {
|
|
let escaped = raw.replace('\\', "\\\\").replace('%', "\\%").replace('_', "\\_");
|
|
format!("%{escaped}%")
|
|
}
|