Prevent us from sql injecting ourselves on backup/restore

Fixes #7478
7 years ago · a2d04f4806
parent 9fb67b9f03
commit a2d04f4806
1 changed files with 1 additions and 1 deletions
--- a/src/org/thoughtcrime/securesms/backup/FullBackupExporter.java
+++ b/src/org/thoughtcrime/securesms/backup/FullBackupExporter.java
@ -143,7 +143,7 @@ public class FullBackupExporter extends FullBackupBase {
          for (int i=0;i<cursor.getColumnCount();i++) {
            if (cursor.getType(i) == Cursor.FIELD_TYPE_STRING) {
              statement.append('\'');
-              statement.append(cursor.getString(i));
+              statement.append(cursor.getString(i).replace("'", "\\'"));
              statement.append('\'');
            } else if (cursor.getType(i) == Cursor.FIELD_TYPE_FLOAT) {
              statement.append(cursor.getFloat(i));