Possible SQL injection in Windows driver utils

[Travis McPeak]

On this line: https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/windows/windows_utils.py#L185 , a raw SQL query is being made with an input. This may be vulnerable to SQL injection attacks if a malicious user is able to tamper with 'vhd_path'.

No input sanitization is done, and no safe SQL libraries are being used. Even if this variable is out the control of a malicious user, this is an unsafe programming practice and should be hardened.

If we are absolutely sure that 'vhd_path' can't be tampered with, it's probably OK to fix this in the open.

[Thierry Carrez (ttx)]

@Alessandro: your help confirming / invalidating the vulnerability needed here too

[Alessandro Pilotti (alexpilotti)]

Hi guys,

This is WQL, not SQL. There are no security concerns for this case.

Please see comments in the following bug report:
https://bugs.launchpad.net/nova/+bug/1370295

[Jeremy Stanley (fungi)]

Switched the bug to public and marked the security advisory task wontfix based on the above explanation.

[Sean McGinnis (sean-mcginnis)]

Closing stale bug. If this is still an issue please reopen.