Arvados

Background¶

Insufficient sanity checking causes an easy client error to generate an obtuse error message.

Resolution¶

Before doing queries, verify that the "select" parameter provided by the client (if any) is not empty and does not contain any invalid entries.

Initial bug report¶

$ bundle exec arv collection list --filters='[["uuid", "=", "su92l-4zz18-hll1sflwwh8ogk1"]]' --select '["writable_by"]'
Error: #<ActiveRecord::StatementInvalid: PG::SyntaxError: ERROR:  syntax error at or near "FROM" 
LINE 1: SELECT   FROM "collections"  WHERE (expires_at IS NULL or ex...
                 ^
: SELECT   FROM "collections"  WHERE (expires_at IS NULL or expires_at > CURRENT_TIMESTAMP) AND ((collections.uuid = 'su92l-4zz18-hll1sflwwh8ogk1')) LIMIT 100 OFFSET 0>

It's not obvious that this is exploitable, but the fact that we're generating an invalid SQL statement without catching the error earlier is very concerning.