fix(security): sanitize timezone parameter value to prevent code injection (#2608)

* fix(security): sanitize timezone parameter value to prevent code injection. Discovered by zhaoyudi (Nebulalab）

Author: sidorares

lib/parsers/binary_parser.js

@@ -42,9 +42,9 @@ function readCodeFor(field, config, options, fieldNum) {
     case Types.TIMESTAMP:
     case Types.NEWDATE:
       if (helpers.typeMatch(field.columnType, dateStrings, Types)) {
-        return `packet.readDateTimeString(${field.decimals});`;
+        return `packet.readDateTimeString(${parseInt(field.decimals, 10)});`;
       }
-      return `packet.readDateTime('${timezone}');`;
+      return `packet.readDateTime(${helpers.srcEscape(timezone)});`;
     case Types.TIME:
       return 'packet.readTimeString()';
     case Types.DECIMAL:

lib/parsers/text_parser.js

@@ -48,13 +48,13 @@ function readCodeFor(type, charset, encodingExpr, config, options) {
       if (helpers.typeMatch(type, dateStrings, Types)) {
         return 'packet.readLengthCodedString("ascii")';
       }
-      return `packet.parseDate('${timezone}')`;
+      return `packet.parseDate(${helpers.srcEscape(timezone)})`;
     case Types.DATETIME:
     case Types.TIMESTAMP:
       if (helpers.typeMatch(type, dateStrings, Types)) {
         return 'packet.readLengthCodedString("ascii")';
       }
-      return `packet.parseDateTime('${timezone}')`;
+      return `packet.parseDateTime(${helpers.srcEscape(timezone)})`;
     case Types.TIME:
       return 'packet.readLengthCodedString("ascii")';
     case Types.GEOMETRY:

test/esm/unit/parsers/timezone-binary-sanitization.test.mjs

@@ -0,0 +1,24 @@
+import { describe, test, assert } from 'poku';
+import { createConnection, describeOptions } from '../../../common.test.cjs';
+
+const connection = createConnection().promise();
+
+describe('Binary Parser: timezone Sanitization', describeOptions);
+
+Promise.all([
+  test(async () => {
+    process.env.TEST_ENV_VALUE = 'secure';
+    await connection.execute({
+      sql: 'SELECT NOW()',
+      timezone: `'); process.env.TEST_ENV_VALUE = "not so much"; //`,
+    });
+
+    assert.strictEqual(
+      process.env.TEST_ENV_VALUE,
+      'secure',
+      'Timezone sanitization failed - code injection possible',
+    );
+  }),
+]).then(async () => {
+  await connection.end();
+});

test/esm/unit/parsers/timezone-text-sanitization.test.mjs

@@ -0,0 +1,24 @@
+import { describe, test, assert } from 'poku';
+import { createConnection, describeOptions } from '../../../common.test.cjs';
+
+const connection = createConnection().promise();
+
+describe('Text Parser: timezone Sanitization', describeOptions);
+
+Promise.all([
+  test(async () => {
+    process.env.TEST_ENV_VALUE = 'secure';
+    await connection.query({
+      sql: 'SELECT NOW()',
+      timezone: `'); process.env.TEST_ENV_VALUE = "not so much"; //`,
+    });
+
+    assert.strictEqual(
+      process.env.TEST_ENV_VALUE,
+      'secure',
+      'Timezone sanitization failed - code injection possible',
+    );
+  }),
+]).then(async () => {
+  await connection.end();
+});