fix(dav): properly parse MKCOL request

SOPE/GDLContentStore/GCSFolderManager.m

@@ -32,10 +32,12 @@
 #import <NGExtensions/NSObject+Logs.h>
 
 #import <GDLAccess/EOAdaptorContext.h>
+#import <GDLAccess/EOAdaptor.h>
 #import <NGExtensions/NGResourceLocator.h>
 
 #import "GCSChannelManager.h"
 #import "EOAdaptorChannel+GCS.h"
+#import "EOQualifier+GCS.h"
 #import "GCSAlarmsFolder.h"
 #import "GCSAdminFolder.h"
 #import "GCSOpenIdFolder.h"
@@ -516,6 +518,9 @@ static BOOL       _singleStoreMode           = NO;
 {
   /* generates a WHERE qualifier for matching the "quick" entries */
   NSMutableString *sql;
+  EOAdaptorChannel* ch;
+  EOAdaptorContext *adaptorContext;
+  EOAdaptor *adaptor;
   unsigned i, count;
   
   if ((count = [_names count]) == 0) {
@@ -523,10 +528,21 @@ static BOOL       _singleStoreMode           = NO;
 	  __PRETTY_FUNCTION__];
     return @"1 = 2";
   }
-  
-  sql = [NSMutableString stringWithCapacity:(count * 8)];
+
+  ch = [self acquireOpenChannel];
+
+  if(!ch) {
+    [self debugWithFormat:@"WARNING(%s): cannot open channel for info folder!",
+	  __PRETTY_FUNCTION__];
+    return @"1 = 2";
+  }
+
+  adaptorContext = [ch adaptorContext];
+  adaptor = [adaptorContext adaptor]; 
+  sql = [NSMutableString stringWithString:@""];
   for (i = 0; i < quickPathCount; i++) {
     NSString *pathColumn;
+    EOQualifier *qualifier;
     char buf[32];
     
     sprintf(buf, GCSPathColumnPattern, (i + 1));
@@ -537,8 +553,11 @@ static BOOL       _singleStoreMode           = NO;
     if (i < count) {
       /* exact match, regular column */
       if ([sql length] > 0) [sql appendString:@" AND "];
-      [sql appendString:pathColumn];
-      [sql appendFormat:@" = '%@'", [_names objectAtIndex:i]];
+
+      qualifier = [[EOKeyValueQualifier alloc] initWithKey: pathColumn
+                                              operatorSelector: EOQualifierOperatorEqual
+                                                         value: [_names objectAtIndex:i]];
+      [qualifier appendSQLToString: sql withAdaptor: adaptor];
     }
     else if (_beExact) {
       /* exact match, ensure that all additional quick-cols are NULL */
@@ -569,9 +588,12 @@ static BOOL       _singleStoreMode           = NO;
   }
   
   if (_beExact && (count > quickPathCount)) {
-    [sql appendString:@" AND c_foldername = '"];
-    [sql appendString:[_names lastObject]];
-    [sql appendString:@"'"];
+    EOQualifier *qualifier;
+    [sql appendString:@" AND "];
+    qualifier = [[EOKeyValueQualifier alloc] initWithKey: @"c_foldername"
+                                              operatorSelector: EOQualifierOperatorEqual
+                                                         value: [_names lastObject]];
+    [qualifier appendSQLToString: sql withAdaptor: adaptor];
   }
   
   return sql;
@@ -992,44 +1014,55 @@ static BOOL       _singleStoreMode           = NO;
 				   andChannel: (EOAdaptorChannel *) channel
 				       atPath: (NSString *) path
 {
-  NSString *baseURL, *tableName, *quickTableName, *aclTableName, *createQuery, *sql;
+  NSString *baseURL, *tableName, *quickTableName, *aclTableName, *createQuery, *sql, *safeFolderName, *safePath;
   GCSSpecialQueries *specialQuery;
   EOAdaptorContext *aContext;
+  EOAdaptor *adaptor;
+  EOAttribute *attribute;
   NSMutableArray *paths;
   NSException *error;
   NSRange range;
   
-  paths = [NSMutableArray arrayWithArray: [path componentsSeparatedByString: @"/"]];
+  aContext = [channel adaptorContext];
+  [aContext beginTransaction];
+
+  //escape foldername to avoid sql injection
+  adaptor = [aContext adaptor];
+
+  attribute = [EOAttribute new];
+  [attribute autorelease];
+  [attribute setExternalType: @"varchar"];
+
+  safeFolderName = [adaptor formatValue: folderName forAttribute: attribute];
+  safePath = [adaptor formatValue: path forAttribute: attribute];
+
+
+  paths = [NSMutableArray arrayWithArray: [safePath componentsSeparatedByString: @"/"]];
 
   while ([paths count] < 5)
     [paths addObject: @"NULL"];
   
-  aContext = [channel adaptorContext];
-  [aContext beginTransaction];
-
   tableName = [self baseTableNameWithUID: [paths objectAtIndex: 2]];
   quickTableName = [tableName stringByAppendingString: @"_quick"];
   aclTableName = [tableName stringByAppendingString: @"_acl"];
 
-  // TBD: fix SQL injection issues.
-  // We no longer call stringByDeletingLastPathComponent since, since GNUstep 1.22,
-  // it'll replace // characters in the URL with /, so mysql:// becomes mysql:/
-  // This is to conform with recent Apple changes.
   baseURL = [folderInfoLocation absoluteString];
   range = [baseURL rangeOfString: @"/" options: NSBackwardsSearch];
   if (range.location != NSNotFound)
     baseURL = [baseURL substringToIndex: range.location];
-  
+
+
+  //Mind the quote, safeFolderName and safePath already have them as they have been escaped, c_path4 already has one at the end
   sql = [NSString stringWithFormat: @"INSERT INTO %@"
 		  @"        (c_path, c_path1, c_path2, c_path3, c_path4,"
 		  @"         c_foldername, c_location, c_quick_location,"
 		  @"         c_acl_location, c_folder_type)"
-		  @" VALUES ('%@', '%@', '%@', '%@', '%@', '%@', '%@/%@',"
+		  @" VALUES (%@, '%@', '%@', '%@', '%@, %@, '%@/%@',"
 		  @"         '%@/%@', '%@/%@', '%@')",
-		  [self folderInfoTableName], path,
+		  [self folderInfoTableName], safePath,
 		  [paths objectAtIndex: 1], [paths objectAtIndex: 2],
 		  [paths objectAtIndex: 3], [paths objectAtIndex: 4],
-		  [folderName stringByReplacingString: @"'" withString: @"''"],
+		  safeFolderName,
 		  baseURL, tableName,
 		  baseURL, quickTableName,
 		  baseURL, aclTableName,