QT/InvoiceShelf
1
0
Fork 0
mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-07-18 06:45:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): block ORDER BY SQL injection via orderByField (GHSA-cp8p) (#663)

Browse Source 
The orderByField/orderBy query params were passed straight into Eloquent's
orderBy() in every model's scopeWhereOrder (and Invoice::scopeApplyFilters),
allowing arbitrary SQL in the ORDER BY clause (boolean-based blind injection).

Adds App\Support\SafeOrderBy::apply() which only accepts a plain, optionally
table-qualified column identifier as the sort target (rejecting expressions,
sub-selects, etc.) and clamps the direction to asc/desc. Routed all 10 model
sort sinks through it. Table-qualified columns stay valid, so joined/aliased
sorts (e.g. estimates by customers.name) are unaffected.

Adds unit tests covering injection rejection, plain + aliased columns, and
direction clamping.
This commit is contained in:
Darko Gjorgjijoski
2026-06-12 09:18:29 +02:00
committed by GitHub
parent 5839d8385d
commit e92b08ef6a
12 changed files with 85 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/Models/Customer.php
View File

@@ -3,6 +3,7 @@
namespace App\Models;
use App\Notifications\CustomerMailResetPasswordNotification;
use App\Support\SafeOrderBy;
use App\Traits\HasCustomFieldsTrait;
use Carbon\Carbon;
use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -269,7 +270,7 @@ class Customer extends Authenticatable implements HasMedia
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereSearch($query, $search)

3
app/Models/Estimate.php
View File

@@ -8,6 +8,7 @@ use App\Facades\PDF;
use App\Mail\SendEstimateMail;
use App\Services\SerialNumberFormatter;
use App\Space\PdfTemplateUtils;
use App\Support\SafeOrderBy;
use App\Traits\GeneratesPdfTrait;
use App\Traits\HasCustomFieldsTrait;
use Carbon\Carbon;
@@ -194,7 +195,7 @@ class Estimate extends Model implements HasMedia
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereCompany($query)

3
app/Models/Expense.php
View File

@@ -2,6 +2,7 @@
namespace App\Models;
use App\Support\SafeOrderBy;
use App\Traits\HasCustomFieldsTrait;
use Carbon\Carbon;
use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -200,7 +201,7 @@ class Expense extends Model implements HasMedia
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereCompany($query)

3
app/Models/FileDisk.php
View File

@@ -2,6 +2,7 @@
namespace App\Models;
use App\Support\SafeOrderBy;
use Carbon\Carbon;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
@@ -32,7 +33,7 @@ class FileDisk extends Model
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeFileDisksBetween($query, $start, $end)

6
app/Models/Invoice.php
View File

@@ -8,6 +8,7 @@ use App\Facades\PDF;
use App\Mail\SendInvoiceMail;
use App\Services\SerialNumberFormatter;
use App\Space\PdfTemplateUtils;
use App\Support\SafeOrderBy;
use App\Traits\GeneratesPdfTrait;
use App\Traits\HasCustomFieldsTrait;
use Carbon\Carbon;
@@ -259,7 +260,7 @@ class Invoice extends Model implements HasMedia
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeApplyFilters($query, array $filters)
@@ -288,7 +289,8 @@ class Invoice extends Model implements HasMedia
$query->where('customer_id', $customerId);
})->when($filters['orderByField'] ?? null, function ($query, $orderByField) use ($filters) {
$orderBy = $filters['orderBy'] ?? 'desc';
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}, function ($query) {
$query->orderBy('sequence_number', 'desc');
});

3
app/Models/Item.php
View File

@@ -2,6 +2,7 @@
namespace App\Models;
use App\Support\SafeOrderBy;
use Carbon\Carbon;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
@@ -63,7 +64,7 @@ class Item extends Model
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereItem($query, $item_id)

3
app/Models/Payment.php
View File

@@ -6,6 +6,7 @@ use App\Facades\Hashids;
use App\Jobs\GeneratePaymentPdfJob;
use App\Mail\SendPaymentMail;
use App\Services\SerialNumberFormatter;
use App\Support\SafeOrderBy;
use App\Traits\GeneratesPdfTrait;
use App\Traits\HasCustomFieldsTrait;
use Barryvdh\DomPDF\Facade\Pdf as PDF;
@@ -356,7 +357,7 @@ class Payment extends Model implements HasMedia
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWherePayment($query, $payment_id)

3
app/Models/RecurringInvoice.php
View File

@@ -5,6 +5,7 @@ namespace App\Models;
use App\Facades\Hashids;
use App\Http\Requests\RecurringInvoiceRequest;
use App\Services\SerialNumberFormatter;
use App\Support\SafeOrderBy;
use App\Traits\HasCustomFieldsTrait;
use Carbon\Carbon;
use Cron;
@@ -132,7 +133,7 @@ class RecurringInvoice extends Model
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereStatus($query, $status)

3
app/Models/TaxType.php
View File

@@ -2,6 +2,7 @@
namespace App\Models;
use App\Support\SafeOrderBy;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;
@@ -73,7 +74,7 @@ class TaxType extends Model
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereSearch($query, $search)

3
app/Models/User.php
View File

@@ -4,6 +4,7 @@ namespace App\Models;
use App\Http\Requests\UserRequest;
use App\Notifications\MailResetPasswordNotification;
use App\Support\SafeOrderBy;
use App\Traits\HasCustomFieldsTrait;
use Carbon\Carbon;
use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -179,7 +180,7 @@ class User extends Authenticatable implements HasMedia
public function scopeWhereOrder($query, $orderByField, $orderBy)
{
$query->orderBy($orderByField, $orderBy);
return SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereSearch($query, $search)