Joomla! Issue Tracker | Joomla! CMS #13180 - full mysql query appears in http status code

Closed
13 Dec 2016
Critical
Build: 3.6.4
# 13180

bell2041
13 Dec 2016

Steps to reproduce the issue

to duplicate the error, just need to make an error in any mysql query and look up the status HTTP status code in Chrome or any other tool (https://httpstatus.io/)

Expected result

The status code should be just : Error 500

Actual result

Joomla shows the entire MySQL query

Status Code:500 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '?option=com_users&view=profile' at line 3 SQL=SELECT lan2guage FROM #__m2enu WHERE c3lient_id = 0 AND id =index.php?option=com_users&view=profile

System information (as much as possible)

I just downloaded and duplicated that problem on the most recent (Joomla! 3.6.4) fresh install

Additional comments

It is very dangerous, because it can be used by the remote attacker to play with the query for the MySQL injection.
The broken query should not be visible anywhere on the site, especially with $error_reporting set to "none"

bell2041 - open - 13 Dec 2016

joomla-cms-bot - labeled - 13 Dec 2016

bell2041 - comment - 13 Dec 2016

The danger is that, this creates a sandbox for an attacker.
It means, they can now try different things and they will see how exactly does the query being structured and reacts to their modifications, and at the end they will modify the query to achieve successful execution of it.

This is very dangerous.

mbabker - comment - 13 Dec 2016

For whomever cares to fix this, as I've commented before, the issue comes down to the fact JDocumentError::render() uses the Exception/Throwable object's message for the HTTP header. This really should just be a standard header value.

mbabker - comment - 13 Dec 2016

Also, the JDatabaseExceptionExecuting that gets thrown from the database API has a property specifically for the SQL query that failed, the database API should be refactored to stop including the query in the Exception message since most error handling simply echoes out the Exception message. If someone needs this query the data should be logged or if you're catching those exceptions you can use $exception->getQuery().

bell2041 - comment - 13 Dec 2016

@mbabker - thank you. this is exactly the place where it needs to be corrected. Can we somehow ask joomla people to fix it in the next joomla update? Otherwise I would need to make this change manually every joomla update.

Thanks again.

mbabker - comment - 13 Dec 2016

Umm, that's exactly what this issue tracker is for, to report a bug ?

Even better, if you can make a change, feel free to submit it as a pull request for it to be considered for inclusion (there is no guarantee any pull request gets accepted, hence the reason I say considered).