Hi all
I'm wondering what the best practice is in terms of detection and
dropping attempted SQL injection attacks?
Is something like the following adequate or can this be enhanced:
if ( $fU != $(fU{s.escape.common}) || $tU != $(tU{s.escape.common}) ) {
drop();
}
Obviously this does not remove the need to escape anything passed to
avp_db_query(), however, what I want to do is identify these sorts of
attacks at the top of the script and avoid processing.
To date all the attacks I've seen focus on the contact and from user, e.g.:
INVITEsip:00111390237920793@x.x.x.x:5060;transport=UDP SIP/2.0
Contact:<sip:a'or'3=3--@x.x.x.x:5060;transport=UDP>
To:<sip:00111390237920793@x.x.x.x;transport=UDP>
From:<sip:a'or'3=3--@x.x.x.x;transport=UDP>;tag=v2pjtxqb
I'm not quite sure how to match the Contact user. Would the following work?
if ( $(ct.fields(uri){uri.user}) !=
$(ct.fields(uri){uri.user}{s.escape.common}) ) {
drop();
}
--
Regards
*Gregory Massel*_______________________________________________
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users
