src/auth.c

   1 /*
   2 ** 2003 January 11
   3 **
   4 ** The author disclaims copyright to this source code.  In place of
   5 ** a legal notice, here is a blessing:
   6 **
   7 **    May you do good and not evil.
   8 **    May you find forgiveness for yourself and forgive others.
   9 **    May you share freely, never taking more than you give.
  10 **
  11 *************************************************************************
  12 ** This file contains code used to implement the sqlite3_set_authorizer()
  13 ** API.  This facility is an optional feature of the library.  Embedded
  14 ** systems that do not need this facility may omit it by recompiling
  15 ** the library with -DSQLITE_OMIT_AUTHORIZATION=1
  16 */
  17 #include "sqliteInt.h"
  18
  19 /*
  20 ** All of the code in this file may be omitted by defining a single
  21 ** macro.
  22 */
  23 #ifndef SQLITE_OMIT_AUTHORIZATION
  24
  25 /*
  26 ** Set or clear the access authorization function.
  27 **
  28 ** The access authorization function is be called during the compilation
  29 ** phase to verify that the user has read and/or write access permission on
  30 ** various fields of the database.  The first argument to the auth function
  31 ** is a copy of the 3rd argument to this routine.  The second argument
  32 ** to the auth function is one of these constants:
  33 **
  34 **       SQLITE_CREATE_INDEX
  35 **       SQLITE_CREATE_TABLE
  36 **       SQLITE_CREATE_TEMP_INDEX
  37 **       SQLITE_CREATE_TEMP_TABLE
  38 **       SQLITE_CREATE_TEMP_TRIGGER
  39 **       SQLITE_CREATE_TEMP_VIEW
  40 **       SQLITE_CREATE_TRIGGER
  41 **       SQLITE_CREATE_VIEW
  42 **       SQLITE_DELETE
  43 **       SQLITE_DROP_INDEX
  44 **       SQLITE_DROP_TABLE
  45 **       SQLITE_DROP_TEMP_INDEX
  46 **       SQLITE_DROP_TEMP_TABLE
  47 **       SQLITE_DROP_TEMP_TRIGGER
  48 **       SQLITE_DROP_TEMP_VIEW
  49 **       SQLITE_DROP_TRIGGER
  50 **       SQLITE_DROP_VIEW
  51 **       SQLITE_INSERT
  52 **       SQLITE_PRAGMA
  53 **       SQLITE_READ
  54 **       SQLITE_SELECT
  55 **       SQLITE_TRANSACTION
  56 **       SQLITE_UPDATE
  57 **
  58 ** The third and fourth arguments to the auth function are the name of
  59 ** the table and the column that are being accessed.  The auth function
  60 ** should return either SQLITE_OK, SQLITE_DENY, or SQLITE_IGNORE.  If
  61 ** SQLITE_OK is returned, it means that access is allowed.  SQLITE_DENY
  62 ** means that the SQL statement will never-run - the sqlite3_exec() call
  63 ** will return with an error.  SQLITE_IGNORE means that the SQL statement
  64 ** should run but attempts to read the specified column will return NULL
  65 ** and attempts to write the column will be ignored.
  66 **
  67 ** Setting the auth function to NULL disables this hook.  The default
  68 ** setting of the auth function is NULL.
  69 */
  70 int sqlite3_set_authorizer(
  71   sqlite3 *db,
  72   int (*xAuth)(void*,int,const char*,const char*,const char*,const char*),
  73   void *pArg
  74 ){
  75 #ifdef SQLITE_ENABLE_API_ARMOR
  76   if( !sqlite3SafetyCheckOk(db) ) return SQLITE_MISUSE_BKPT;
  77 #endif
  78   sqlite3_mutex_enter(db->mutex);
  79   db->xAuth = (sqlite3_xauth)xAuth;
  80   db->pAuthArg = pArg;
  81   sqlite3ExpirePreparedStatements(db);
  82   sqlite3_mutex_leave(db->mutex);
  83   return SQLITE_OK;
  84 }
  85
  86 /*
  87 ** Write an error message into pParse->zErrMsg that explains that the
  88 ** user-supplied authorization function returned an illegal value.
  89 */
  90 static void sqliteAuthBadReturnCode(Parse *pParse){
  91   sqlite3ErrorMsg(pParse, "authorizer malfunction");
  92   pParse->rc = SQLITE_ERROR;
  93 }
  94
  95 /*
  96 ** Invoke the authorization callback for permission to read column zCol from
  97 ** table zTab in database zDb. This function assumes that an authorization
  98 ** callback has been registered (i.e. that sqlite3.xAuth is not NULL).
  99 **
 100 ** If SQLITE_IGNORE is returned and pExpr is not NULL, then pExpr is changed
 101 ** to an SQL NULL expression. Otherwise, if pExpr is NULL, then SQLITE_IGNORE
 102 ** is treated as SQLITE_DENY. In this case an error is left in pParse.
 103 */
 104 int sqlite3AuthReadCol(
 105   Parse *pParse,                  /* The parser context */
 106   const char *zTab,               /* Table name */
 107   const char *zCol,               /* Column name */
 108   int iDb                         /* Index of containing database. */
 109 ){
 110   sqlite3 *db = pParse->db;          /* Database handle */
 111   char *zDb = db->aDb[iDb].zDbSName; /* Schema name of attached database */
 112   int rc;                            /* Auth callback return code */
 113
 114   if( db->init.busy ) return SQLITE_OK;
 115   rc = db->xAuth(db->pAuthArg, SQLITE_READ, zTab,zCol,zDb,pParse->zAuthContext
 116 #ifdef SQLITE_USER_AUTHENTICATION
 117                  ,db->auth.zAuthUser
 118 #endif
 119                 );
 120   if( rc==SQLITE_DENY ){
 121     char *z = sqlite3_mprintf("%s.%s", zTab, zCol);
 122     if( db->nDb>2 || iDb!=0 ) z = sqlite3_mprintf("%s.%z", zDb, z);
 123     sqlite3ErrorMsg(pParse, "access to %z is prohibited", z);
 124     pParse->rc = SQLITE_AUTH;
 125   }else if( rc!=SQLITE_IGNORE && rc!=SQLITE_OK ){
 126     sqliteAuthBadReturnCode(pParse);
 127   }
 128   return rc;
 129 }
 130
 131 /*
 132 ** The pExpr should be a TK_COLUMN expression.  The table referred to
 133 ** is in pTabList or else it is the NEW or OLD table of a trigger.
 134 ** Check to see if it is OK to read this particular column.
 135 **
 136 ** If the auth function returns SQLITE_IGNORE, change the TK_COLUMN
 137 ** instruction into a TK_NULL.  If the auth function returns SQLITE_DENY,
 138 ** then generate an error.
 139 */
 140 void sqlite3AuthRead(
 141   Parse *pParse,        /* The parser context */
 142   Expr *pExpr,          /* The expression to check authorization on */
 143   Schema *pSchema,      /* The schema of the expression */
 144   SrcList *pTabList     /* All table that pExpr might refer to */
 145 ){
 146   sqlite3 *db = pParse->db;
 147   Table *pTab = 0;      /* The table being read */
 148   const char *zCol;     /* Name of the column of the table */
 149   int iSrc;             /* Index in pTabList->a[] of table being read */
 150   int iDb;              /* The index of the database the expression refers to */
 151   int iCol;             /* Index of column in table */
 152
 153   assert( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER );
 154   if( db->xAuth==0 ) return;
 155   iDb = sqlite3SchemaToIndex(pParse->db, pSchema);
 156   if( iDb<0 ){
 157     /* An attempt to read a column out of a subquery or other
 158     ** temporary table. */
 159     return;
 160   }
 161
 162   if( pExpr->op==TK_TRIGGER ){
 163     pTab = pParse->pTriggerTab;
 164   }else{
 165     assert( pTabList );
 166     for(iSrc=0; ALWAYS(iSrc<pTabList->nSrc); iSrc++){
 167       if( pExpr->iTable==pTabList->a[iSrc].iCursor ){
 168         pTab = pTabList->a[iSrc].pTab;
 169         break;
 170       }
 171     }
 172   }
 173   iCol = pExpr->iColumn;
 174   if( NEVER(pTab==0) ) return;
 175
 176   if( iCol>=0 ){
 177     assert( iCol<pTab->nCol );
 178     zCol = pTab->aCol[iCol].zName;
 179   }else if( pTab->iPKey>=0 ){
 180     assert( pTab->iPKey<pTab->nCol );
 181     zCol = pTab->aCol[pTab->iPKey].zName;
 182   }else{
 183     zCol = "ROWID";
 184   }
 185   assert( iDb>=0 && iDb<db->nDb );
 186   if( SQLITE_IGNORE==sqlite3AuthReadCol(pParse, pTab->zName, zCol, iDb) ){
 187     pExpr->op = TK_NULL;
 188   }
 189 }
 190
 191 /*
 192 ** Do an authorization check using the code and arguments given.  Return
 193 ** either SQLITE_OK (zero) or SQLITE_IGNORE or SQLITE_DENY.  If SQLITE_DENY
 194 ** is returned, then the error count and error message in pParse are
 195 ** modified appropriately.
 196 */
 197 int sqlite3AuthCheck(
 198   Parse *pParse,
 199   int code,
 200   const char *zArg1,
 201   const char *zArg2,
 202   const char *zArg3
 203 ){
 204   sqlite3 *db = pParse->db;
 205   int rc;
 206
 207   /* Don't do any authorization checks if the database is initialising
 208   ** or if the parser is being invoked from within sqlite3_declare_vtab.
 209   */
 210   if( db->init.busy || IN_DECLARE_VTAB ){
 211     return SQLITE_OK;
 212   }
 213
 214   if( db->xAuth==0 ){
 215     return SQLITE_OK;
 216   }
 217
 218   /* EVIDENCE-OF: R-43249-19882 The third through sixth parameters to the
 219   ** callback are either NULL pointers or zero-terminated strings that
 220   ** contain additional details about the action to be authorized.
 221   **
 222   ** The following testcase() macros show that any of the 3rd through 6th
 223   ** parameters can be either NULL or a string. */
 224   testcase( zArg1==0 );
 225   testcase( zArg2==0 );
 226   testcase( zArg3==0 );
 227   testcase( pParse->zAuthContext==0 );
 228
 229   rc = db->xAuth(db->pAuthArg, code, zArg1, zArg2, zArg3, pParse->zAuthContext
 230 #ifdef SQLITE_USER_AUTHENTICATION
 231                  ,db->auth.zAuthUser
 232 #endif
 233                 );
 234   if( rc==SQLITE_DENY ){
 235     sqlite3ErrorMsg(pParse, "not authorized");
 236     pParse->rc = SQLITE_AUTH;
 237   }else if( rc!=SQLITE_OK && rc!=SQLITE_IGNORE ){
 238     rc = SQLITE_DENY;
 239     sqliteAuthBadReturnCode(pParse);
 240   }
 241   return rc;
 242 }
 243
 244 /*
 245 ** Push an authorization context.  After this routine is called, the
 246 ** zArg3 argument to authorization callbacks will be zContext until
 247 ** popped.  Or if pParse==0, this routine is a no-op.
 248 */
 249 void sqlite3AuthContextPush(
 250   Parse *pParse,
 251   AuthContext *pContext,
 252   const char *zContext
 253 ){
 254   assert( pParse );
 255   pContext->pParse = pParse;
 256   pContext->zAuthContext = pParse->zAuthContext;
 257   pParse->zAuthContext = zContext;
 258 }
 259
 260 /*
 261 ** Pop an authorization context that was previously pushed
 262 ** by sqlite3AuthContextPush
 263 */
 264 void sqlite3AuthContextPop(AuthContext *pContext){
 265   if( pContext->pParse ){
 266     pContext->pParse->zAuthContext = pContext->zAuthContext;
 267     pContext->pParse = 0;
 268   }
 269 }
 270
 271 #endif /* SQLITE_OMIT_AUTHORIZATION */