[WTEL-10639]security(sqlite): restrict sqlite DSN connection strings

app/app.go

@@ -120,10 +120,6 @@ func NewFlowManager() (outApp *FlowManager, outErr error) {
 		cbr:         NewCallbackResolver(),
 	}
 
-	if config.ExternalSql {
-		fm.ExternalStore = cachelayer.NewExternalStoreManager()
-	}
-
 	logConfig := &wlog.LoggerConfiguration{
 		EnableConsole: config.Log.Console,
 		ConsoleJson:   false,
@@ -162,6 +158,19 @@ func NewFlowManager() (outApp *FlowManager, outErr error) {
 	wlog.RedirectStdLog(fm.log)
 	wlog.InitGlobalLogger(fm.log)
 
+	if config.ExternalSQLSettings.Enabled {
+		if err := config.ExternalSQLSettings.Prepare(); err != nil {
+			config.ExternalSQLSettings.SanitazeOnPrepareFailure()
+			wlog.Error("prepare external sql settings", wlog.Err(err))
+		}
+
+		fm.ExternalStore = cachelayer.NewExternalStoreManager(
+			cachelayer.WithSQLLiteSandboxDir(config.ExternalSQLSettings.SandboxRootDirectory),
+			cachelayer.WithWriteOperationsEnabled(config.ExternalSQLSettings.WriteEnabled),
+			cachelayer.WithLogger(wlog.GlobalLogger().With(wlog.Namespace("external_sql"))),
+		)
+	}
+
 	// Bind http.DefaultTransport to the proxy manager before any outbound
 	// client is built, so every default-transport call site follows the
 	// watched proxy settings without a restart.

app/sql.go

@@ -1,17 +1,25 @@
 package app
 
 import (
+	"context"
+	"net/http"
+
 	"github.com/webitel/flow_manager/model"
 	"github.com/webitel/flow_manager/store/cachelayer"
-	"net/http"
 )
 
 var ErrExternalStoreDisabled = model.NewAppError("App", "app.settings.sql.external.disabled", nil, "External store disabled", http.StatusForbidden)
 
-func (fm *FlowManager) GetSqlDb(driver, dns string) (*cachelayer.ExternalDb, *model.AppError) {
+func (fm *FlowManager) GetSqlDb(ctx context.Context, driver, dns string, writable bool) (*cachelayer.ExternalDb, *model.AppError) {
 	if fm.ExternalStore == nil {
 		return nil, ErrExternalStoreDisabled
 	}
 
-	return fm.ExternalStore.Connect(driver, dns)
+	connectCfg := cachelayer.ExternalSQLStoreConnectConfig{
+		Driver:   driver,
+		DSN:      dns,
+		Writable: writable,
+	}
+
+	return fm.ExternalStore.Connect(ctx, &connectCfg)
 }

flow/sql.go

@@ -2,16 +2,18 @@ package flow
 
 import (
 	"context"
-	"github.com/webitel/flow_manager/model"
 	"time"
+
+	"github.com/webitel/flow_manager/model"
 )
 
 type SqlArgs struct {
-	Driver  string        `json:"driver"`
-	Dns     string        `json:"dns"`
-	Query   string        `json:"query"`
-	Params  []interface{} `json:"params"`
-	Timeout int           `json:"timeout"`
+	Driver   string        `json:"driver"`
+	Dns      string        `json:"dns"`
+	Query    string        `json:"query"`
+	Params   []interface{} `json:"params"`
+	Timeout  int           `json:"timeout"`
+	Writable bool          `json:"writable"`
 }
 
 func (r *router) SqlHandler(ctx context.Context, scope *Flow, conn model.Connection, args interface{}) (model.Response, *model.AppError) {
@@ -33,12 +35,13 @@ func (r *router) SqlHandler(ctx context.Context, scope *Flow, conn model.Connect
 		return nil, ErrorRequiredParameter("sql", "dns")
 	}
 
-	db, err := r.fm.GetSqlDb(req.Driver, req.Dns)
+	db, err := r.fm.GetSqlDb(ctx, req.Driver, req.Dns, req.Writable)
 	if err != nil {
 		return model.CallResponseError, err
 	}
 
-	c, _ := context.WithTimeout(ctx, time.Duration(req.Timeout)*time.Millisecond)
+	c, cancel := context.WithTimeout(ctx, time.Duration(req.Timeout)*time.Millisecond)
+	defer cancel()
 
 	result, err := db.Query(c, req.Query, req.Params)
 	if err != nil {

go.mod

@@ -24,7 +24,7 @@ require (
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/k3a/html2text v1.2.1
 	github.com/lib/pq v1.10.9
-	github.com/mattn/go-sqlite3 v1.14.28
+	github.com/mattn/go-sqlite3 v1.14.52
 	github.com/mbobakov/grpc-consul-resolver v1.5.3
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/pborman/uuid v1.2.1

go.sum

@@ -219,6 +219,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
 github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.52 h1:wVbm2Qnf4OXkqhBTSPuCRZDRnxfbVrrmiCEroVdog8U=
+github.com/mattn/go-sqlite3 v1.14.52/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mbobakov/grpc-consul-resolver v1.5.3 h1:xL7nJm8qCvxgHMqlnF4naXruBUoHqfUWORl3UmwKByU=
 github.com/mbobakov/grpc-consul-resolver v1.5.3/go.mod h1:0wN8+McBocuk5mO9xlAfrmBSothm7sps43bFGubg0m4=

model/config.go

@@ -1,15 +1,21 @@
 package model
 
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
 const (
 	DATABASE_DRIVER_POSTGRES = "postgres"
 )
 
 type Config struct {
-	ConfigFile  *string `json:"-" flag:"config_file||JSON file configuration"`
-	Id          string  `json:"id" flag:"id|1|Service id" env:"ID"`
-	ExternalSql bool    `json:"external_sql" flag:"external_sql|false|Enable external sql query" env:"EXTERNAL_SQL"`
-	AllowUseMQ  bool    `json:"allow_use_mq" flag:"allow_use_mq|false|Allow push message to MQ" env:"ALLOW_USE_MQ"`
-	Record      struct {
+	ConfigFile *string `json:"-" flag:"config_file||JSON file configuration"`
+	Id         string  `json:"id" flag:"id|1|Service id" env:"ID"`
+	AllowUseMQ bool    `json:"allow_use_mq" flag:"allow_use_mq|false|Allow push message to MQ" env:"ALLOW_USE_MQ"`
+	Record     struct {
 		Sample int `json:"sample" flag:"record_sample|0|Set the sample rate of the recording" env:"RECORD_SAMPLE"`
 	} `json:"record"`
 	DebugImap                    bool              `json:"debug_imap" flag:"debug_imap|false|Debug IMAP protocol" env:"DEBUG_IMAP"`
@@ -26,6 +32,7 @@ type Config struct {
 	ChatTemplatesSettings ChatTemplatesSettings `json:"chat_templates_settings,omitempty"`
 	Log                   LogSettings           `json:"log"`
 	Tls                   TLSConfig             `json:"tls"`
+	ExternalSQLSettings   ExternalSQLSettings   `json:"external_sql_settings"`
 	ProxyConfigFile       string                `json:"proxy_config_file" flag:"proxy_config_file||Proxy settings file (http_proxy/https_proxy/no_proxy) watched for changes" env:"PROXY_CONFIG_FILE"`
 }
 
@@ -92,3 +99,43 @@ type MQSettings struct {
 	Url   string `json:"url" flag:"amqp|amqp://admin:admin@rabbit:5672?heartbeat=10|AMQP connection" env:"AMQP"`
 	UseIM bool   `json:"use_im" flag:"use_im|false|Use IM handlers" env:"USE_IM"`
 }
+
+type ExternalSQLSettings struct {
+	Enabled              bool   `json:"enabled" flag:"external_sql|false|Enable use of external SQL stores" env:"EXTERNAL_SQL"`
+	SandboxRootDirectory string `json:"root_directory" flag:"external_sql_sandbox_directory|/var/lib/webitel/webitel-flow-manager/sqlite|Root path for sandbox SQLLite access directory" env:"EXTERNAL_SQL_SANDBOX_DIRECTORY"`
+	WriteEnabled         bool   `json:"writable" flag:"external_sql_write_enabled|false|Is enabled write operations with external SQL stores" env:"EXTERNAL_SQL_WRITE_ENABLED"`
+}
+
+var ErrEmptyExternalSQLSandbox = NewAppError("Config", "model.config.external_sql_settings.empty", nil, "empty external sql sandbox dir", 400)
+
+func (s *ExternalSQLSettings) Prepare() *AppError {
+	if strings.TrimSpace(s.SandboxRootDirectory) == "" {
+		return ErrEmptyExternalSQLSandbox
+	}
+
+	if !filepath.IsAbs(s.SandboxRootDirectory) {
+		return NewAppError("Config", "model.config.external_sql_settings.not_absolute", nil, "sandbox root must be absolute", 400)
+	}
+
+	real, err := filepath.EvalSymlinks(filepath.Clean(s.SandboxRootDirectory))
+	if err != nil {
+		return NewAppError("Config", "model.config.external_sql_settings.sandbox_root", nil, fmt.Sprintf("sandbox root %+v", err), 400)
+	}
+
+	fi, err := os.Stat(real)
+	if err != nil || !fi.IsDir() {
+		return NewAppError("Config", "model.config.external_sql_settings.sandbox_not_dir", nil, "sandbox root path must be an existing directory", 400)
+	}
+
+	if fi.Mode().Perm()&0o002 != 0 {
+		return NewAppError("Config", "model.config.external_sql_settings.word_writable", nil, "sandbox root must not be a world writable", 400)
+	}
+
+	s.SandboxRootDirectory = real
+
+	return nil
+}
+
+func (s *ExternalSQLSettings) SanitazeOnPrepareFailure() {
+	s.SandboxRootDirectory = ""
+}