dbhub.io
dbhub.io copied to clipboard
sqlitebrowser
Probably need a better SQLite database validator
After looking through this DefCon presentation, I'm thinking server-side we'll likely need to write a much more in depth validator for SQLite database uploads:
- https://www.blackhat.com/docs/us-17/wednesday/us-17-Feng-Many-Birds-One-Stone-Exploiting-A-Single-SQLite-Vulnerability-Across-Multiple-Software.pdf
At present, our validator just checks if the uploaded file is a "valid" SQLite database by attempting to open it and read some basic info. Sounds like it needs to be a bunch more in-depth, just to ensure we're not accepting (then potentially allowing distribution of) booby-trapped databases.
On a similar note, we should ensure the SQLCipher version included with DB4S 3.10.0 addresses (at least) the mentioned CVE's.
Will there be a 'reporting' system? ie, if someone opens a public database and notices something wacky, if they 'report' it, its immediately taken out of public-ness, until verified, etc. I'm thinking if someone just emails in, it could get missed or if someone is on holiday then it won't get actioned, but if something 'automatic' was there, it could be instant. There is the risk this could be taken advantage of, but it would be linked against a user/IP, etc... chris continues mumbling in the background...
Hmmm, yeah. Some kind of "flag this database for review" system could probably be introduced. We'd need to think of how/what/where/when (etc) for it.
Closing this, as we've been doing fairly extensive validation for quite a while now.