hans/Nominatim
1
0
Fork 1
mirror of https://github.com/osm-search/Nominatim.git synced 2026-03-12 05:44:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

improve code to collect the PostGIS version

Browse Source 
The SQL contained an unchecked string literal, which may in theory be
used to attack the database.
This commit is contained in:
Sarah Hoffmann
2023-11-16 11:02:25 +01:00
parent 2a5c6b1570
commit 07120f9af5
1 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
nominatim/tools/collect_os_info.py
View File

@@ -12,14 +12,13 @@ import os
import subprocess import subprocess
import sys import sys
from pathlib import Path from pathlib import Path
from typing import List, Optional, Tuple, Union, cast from typing import List, Optional, Tuple, Union
import psutil import psutil
from psycopg2.extensions import make_dsn, parse_dsn from psycopg2.extensions import make_dsn, parse_dsn
from nominatim.config import Configuration from nominatim.config import Configuration
from nominatim.db.connection import connect from nominatim.db.connection import connect
from nominatim.typing import DictCursorResults
from nominatim.version import NOMINATIM_VERSION from nominatim.version import NOMINATIM_VERSION
@@ -107,15 +106,15 @@ def report_system_information(config: Configuration) -> None:
postgresql_ver: str = convert_version(conn.server_version_tuple()) postgresql_ver: str = convert_version(conn.server_version_tuple())
with conn.cursor() as cur: with conn.cursor() as cur:
cur.execute(f""" num = cur.scalar("SELECT count(*) FROM pg_catalog.pg_database WHERE datname=%s",
SELECT datname FROM pg_catalog.pg_database (parse_dsn(config.get_libpq_dsn())['dbname'], ))
WHERE datname='{parse_dsn(config.get_libpq_dsn())['dbname']}'""") nominatim_db_exists = num == 1 if isinstance(num, int) else False
nominatim_db_exists = cast(Optional[DictCursorResults], cur.fetchall())
if nominatim_db_exists: if nominatim_db_exists:
with connect(config.get_libpq_dsn()) as conn: with connect(config.get_libpq_dsn()) as conn:
postgis_ver: str = convert_version(conn.postgis_version_tuple()) postgis_ver: str = convert_version(conn.postgis_version_tuple())
else: else:
postgis_ver = "Unable to connect to database" postgis_ver = "Unable to connect to database"
postgresql_config: str = get_postgresql_config(int(float(postgresql_ver))) postgresql_config: str = get_postgresql_config(int(float(postgresql_ver)))