1 /*
2 * Copyright (C) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "medialibrary_common_utils.h"
17
18 #include <algorithm>
19 #include <regex>
20 #include <unordered_set>
21 #include "medialibrary_errno.h"
22 #include "medialibrary_db_const.h"
23 #include "medialibrary_tracer.h"
24 #include "media_log.h"
25 #include "openssl/sha.h"
26
27 namespace OHOS {
28 namespace Media {
29 using namespace std;
30 const vector<string> CHAR2HEX_TABLE = {
31 "00", "01", "02", "03", "04", "05", "06", "07", "08", "09", "0A", "0B", "0C", "0D", "0E", "0F",
32 "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "1A", "1B", "1C", "1D", "1E", "1F",
33 "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "2A", "2B", "2C", "2D", "2E", "2F",
34 "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "3A", "3B", "3C", "3D", "3E", "3F",
35
36 "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "4A", "4B", "4C", "4D", "4E", "4F",
37 "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "5A", "5B", "5C", "5D", "5E", "5F",
38 "60", "61", "62", "63", "64", "65", "66", "67", "68", "69", "6A", "6B", "6C", "6D", "6E", "6F",
39 "70", "71", "72", "73", "74", "75", "76", "77", "78", "79", "7A", "7B", "7C", "7D", "7E", "7F",
40
41 "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "8A", "8B", "8C", "8D", "8E", "8F",
42 "90", "91", "92", "93", "94", "95", "96", "97", "98", "99", "9A", "9B", "9C", "9D", "9E", "9F",
43 "A0", "A1", "A2", "A3", "A4", "A5", "A6", "A7", "A8", "A9", "AA", "AB", "AC", "AD", "AE", "AF",
44 "B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8", "B9", "BA", "BB", "BC", "BD", "BE", "BF",
45
46 "C0", "C1", "C2", "C3", "C4", "C5", "C6", "C7", "C8", "C9", "CA", "CB", "CC", "CD", "CE", "CF",
47 "D0", "D1", "D2", "D3", "D4", "D5", "D6", "D7", "D8", "D9", "DA", "DB", "DC", "DD", "DE", "DF",
48 "E0", "E1", "E2", "E3", "E4", "E5", "E6", "E7", "E8", "E9", "EA", "EB", "EC", "ED", "EE", "EF",
49 "F0", "F1", "F2", "F3", "F4", "F5", "F6", "F7", "F8", "F9", "FA", "FB", "FC", "FD", "FE", "FF"
50 };
51
52 const std::unordered_set<std::string> fileKeyWhiteListUSet {
53 MEDIA_DATA_DB_ID,
54 MEDIA_DATA_DB_RELATIVE_PATH,
55 MEDIA_DATA_DB_NAME,
56 MEDIA_DATA_DB_PARENT_ID,
57 MEDIA_DATA_DB_MIME_TYPE,
58 MEDIA_DATA_DB_MEDIA_TYPE,
59 MEDIA_DATA_DB_SIZE,
60 MEDIA_DATA_DB_DATE_ADDED,
61 MEDIA_DATA_DB_DATE_MODIFIED,
62 MEDIA_DATA_DB_DATE_TAKEN,
63 MEDIA_DATA_DB_TITLE,
64 MEDIA_DATA_DB_ARTIST,
65 MEDIA_DATA_DB_AUDIO_ALBUM,
66 MEDIA_DATA_DB_DURATION,
67 MEDIA_DATA_DB_WIDTH,
68 MEDIA_DATA_DB_HEIGHT,
69 MEDIA_DATA_DB_ORIENTATION,
70 MEDIA_DATA_DB_BUCKET_ID,
71 MEDIA_DATA_DB_BUCKET_NAME,
72 CATEGORY_MEDIATYPE_DIRECTORY_DB_DIRECTORY_TYPE,
73 MEDIA_DATA_DB_DATE_TRASHED,
74 MEDIA_DATA_DB_BUCKET_ID,
75 MEDIA_DATA_DB_ALBUM_ID,
76 DEVICE_DB_NETWORK_ID
77 };
78
Char2Hex(const unsigned char * data,const size_t len,std::string & hexStr)79 void MediaLibraryCommonUtils::Char2Hex(const unsigned char *data, const size_t len, std::string &hexStr)
80 {
81 constexpr int CHAR_WIDTH = 8;
82 constexpr int HEX_WIDTH = 4;
83 constexpr size_t OUT_HEXSTR_SIZE = SHA256_DIGEST_LENGTH * (CHAR_WIDTH / HEX_WIDTH);
84 hexStr = "";
85 hexStr.reserve(OUT_HEXSTR_SIZE);
86 for (size_t i = 0; i < len; i++) {
87 hexStr.append(CHAR2HEX_TABLE[data[i]]);
88 }
89 }
90
GenKey(const unsigned char * data,const size_t len,std::string & key)91 int32_t MediaLibraryCommonUtils::GenKey(const unsigned char *data, const size_t len, std::string &key)
92 {
93 if (len == 0 || len > LONG_MAX) {
94 return -EINVAL;
95 }
96
97 unsigned char hash[SHA256_DIGEST_LENGTH] = "";
98 SHA256_CTX ctx;
99 SHA256_Init(&ctx);
100 SHA256_Update(&ctx, data, len);
101 SHA256_Final(hash, &ctx);
102
103 /* here we translate sha256 hash to hexadecimal. each 8-bit char will be presented by two characters([0-9a-f]) */
104 Char2Hex(hash, SHA256_DIGEST_LENGTH, key);
105 return E_OK;
106 }
107
GenKeySHA256(const std::vector<uint8_t> & input,std::string & key)108 int32_t MediaLibraryCommonUtils::GenKeySHA256(const std::vector<uint8_t> &input, std::string &key)
109 {
110 return GenKey(input.data(), input.size(), key);
111 }
112
GenKeySHA256(const std::string & input,std::string & key)113 int32_t MediaLibraryCommonUtils::GenKeySHA256(const std::string &input, std::string &key)
114 {
115 return GenKey((const unsigned char *)input.c_str(), input.size(), key);
116 }
117
ExtractKeyWord(std::string & str)118 void MediaLibraryCommonUtils::ExtractKeyWord(std::string &str)
119 {
120 if (str.empty()) {
121 return;
122 }
123 // add seprate space symbol,like file_id=?
124 std::regex spacePattern("\\=|\\<>|\\>|\\>=|\\<|\\<=|\\!=",
125 std::regex_constants::ECMAScript | std::regex_constants::icase);
126 str = regex_replace(str, spacePattern, " ");
127 // remove front space of key word
128 auto pos = str.find_first_not_of(" ");
129 if (pos != std::string::npos) {
130 str.erase(0, pos);
131 }
132 // remove back space of key word
133 pos = str.find_first_of(" ");
134 if (pos != std::string::npos) {
135 str = str.substr(0, pos);
136 }
137 }
138
CheckWhiteList(const std::string & express)139 bool MediaLibraryCommonUtils::CheckWhiteList(const std::string &express)
140 {
141 if (fileKeyWhiteListUSet.find(express) != fileKeyWhiteListUSet.end()) {
142 return true;
143 }
144
145 return false;
146 }
147
CheckExpressValidation(std::vector<std::string> & sepratedStr)148 bool MediaLibraryCommonUtils::CheckExpressValidation(std::vector<std::string> &sepratedStr)
149 {
150 for (auto &str : sepratedStr) {
151 ExtractKeyWord(str);
152 if (str.empty() || (str.size() == 1 && str == " ")) {
153 continue;
154 }
155 if (!CheckWhiteList(str)) {
156 return false;
157 }
158 }
159
160 return true;
161 }
162
removeSpecialCondition(std::string & hacker,const std::string & pattern)163 void MediaLibraryCommonUtils::removeSpecialCondition(std::string &hacker, const std::string &pattern)
164 {
165 auto pos = hacker.find(pattern);
166 while (pos != std::string::npos) {
167 hacker.replace(pos, pos + pattern.size(), " ");
168 pos = hacker.find(pattern);
169 }
170 }
171
removeSpecialCondition(std::string & hacker)172 void MediaLibraryCommonUtils::removeSpecialCondition(std::string &hacker)
173 {
174 const std::string S1 = "not between ? and ?";
175 const std::string S2 = "between ? and ?";
176 removeSpecialCondition(hacker, S1);
177 removeSpecialCondition(hacker, S2);
178 }
179
SeprateSelection(std::string & strCondition,std::vector<std::string> & sepratedStr)180 void MediaLibraryCommonUtils::SeprateSelection(std::string &strCondition, std::vector<std::string> &sepratedStr)
181 {
182 // 0. transform to lower
183 std::transform(strCondition.begin(), strCondition.end(), strCondition.begin(), ::tolower);
184 // 1.remove brackets
185 std::regex bracketsPattern("\\(|\\)", std::regex_constants::ECMAScript | std::regex_constants::icase);
186 strCondition = regex_replace(strCondition, bracketsPattern, "");
187
188 // 2.remove redundant space
189 std::regex spacePattern("\\s+", std::regex_constants::ECMAScript | std::regex_constants::icase);
190 strCondition = regex_replace(strCondition, spacePattern, " ");
191
192 // 3. remove special condition
193 removeSpecialCondition(strCondition);
194
195 // 4. seprate core: according bound symbol,for example: and or ..
196 std::regex conditionPattern("\\s*and\\s+|\\s*or\\s+",
197 std::regex_constants::ECMAScript | std::regex_constants::icase);
198 std::sregex_token_iterator iter(strCondition.begin(), strCondition.end(), conditionPattern, -1);
199 decltype(iter) end;
200 while (iter != end) {
201 sepratedStr.push_back(iter->str());
202 ++iter;
203 }
204 }
205
CheckKeyWord(const std::string & strCondition)206 bool MediaLibraryCommonUtils::CheckKeyWord(const std::string &strCondition)
207 {
208 std::regex pattern("\\s*exec\\s*|\\s*insert\\s*|\\s*delete\\s*|\\s*update\\s*|" \
209 "\\s*join\\s*|\\s*union\\s*|\\s*master\\s*|\\s*truncate\\s*",
210 std::regex_constants::ECMAScript | std::regex_constants::icase);
211
212 if (regex_search(strCondition, pattern)) {
213 return false;
214 }
215
216 return true;
217 }
218
CheckIllegalCharacter(const std::string & strCondition)219 bool MediaLibraryCommonUtils::CheckIllegalCharacter(const std::string &strCondition)
220 {
221 /* if strCondition contains ';', it will be sepreate to two clause */
222 if (strCondition.find(';') == std::string::npos) {
223 return true;
224 }
225 /* other check to do */
226 return false;
227 }
228
CheckWhereClause(const std::string & whereClause)229 bool MediaLibraryCommonUtils::CheckWhereClause(const std::string &whereClause)
230 {
231 MediaLibraryTracer tracer;
232 tracer.Start("CommonUtils::CheckWhereClause");
233 if (whereClause.empty() || (whereClause.size() == 1 && whereClause == " ")) {
234 return true;
235 }
236 /* check whether query condition has illegal character */
237 if (!CheckIllegalCharacter(whereClause)) {
238 return false;
239 }
240
241 /* check whether query condition has key word */
242 if (!CheckKeyWord(whereClause)) {
243 return false;
244 }
245
246 std::vector<std::string> sepratedStr;
247 auto args = whereClause;
248 SeprateSelection(args, sepratedStr);
249 /* check every query condition */
250 return CheckExpressValidation(sepratedStr);
251 }
252
AppendSelections(std::string & selections)253 void MediaLibraryCommonUtils::AppendSelections(std::string &selections)
254 {
255 if (selections.empty()) {
256 return;
257 }
258 selections = "(" + selections + ")";
259 }
260 } // namespace Media
261 } // namespace OHOS
262