QT/InvoiceShelf
1
0
Fork 0
mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-07-16 22:05:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): block ORDER BY SQL injection via orderByField (GHSA-cp8p) (#670)

Browse Source 
v3 port. orderByField/orderBy were passed straight into Eloquent's orderBy()
in every model's scopeWhereOrder (and Invoice::scopeApplyFilters), allowing
arbitrary SQL in the ORDER BY clause.

Adds App\Support\SafeOrderBy::apply() (plain/table-qualified column identifier
only, asc/desc clamp) and routes all 10 model sort sinks through it. Aliased
sorts (e.g. estimates by customers.name) stay valid.

Adds unit tests for injection rejection, plain + aliased columns, direction clamp.
This commit is contained in:
Darko Gjorgjijoski
2026-06-12 11:02:15 +02:00
committed by GitHub
parent e56b6b4fe5
commit ca6dd57bf9
12 changed files with 85 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/Models/Estimate.php
View File

@@ -5,6 +5,7 @@ namespace App\Models;
use App\Services\Document\EstimateService;
use App\Support\Pdf\PdfHtmlSanitizer;
use App\Support\Pdf\PdfTemplateUtils;
use App\Support\SafeOrderBy;
use App\Traits\GeneratesPdfTrait;
use App\Traits\HasCustomFieldsTrait;
use Carbon\Carbon;
@@ -191,7 +192,7 @@ class Estimate extends Model implements HasMedia
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereCompany($query)