mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-16 22:05:20 +00:00
ca6dd57bf9
v3 port. orderByField/orderBy were passed straight into Eloquent's orderBy() in every model's scopeWhereOrder (and Invoice::scopeApplyFilters), allowing arbitrary SQL in the ORDER BY clause. Adds App\Support\SafeOrderBy::apply() (plain/table-qualified column identifier only, asc/desc clamp) and routes all 10 model sort sinks through it. Aliased sorts (e.g. estimates by customers.name) stay valid. Adds unit tests for injection rejection, plain + aliased columns, direction clamp.
32 lines
1.2 KiB
PHP
32 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace App\Support;
|
|
|
|
class SafeOrderBy
|
|
{
|
|
/**
|
|
* Apply a safe ORDER BY clause.
|
|
*
|
|
* The orderByField / orderBy values originate from user-supplied query
|
|
* parameters and were previously passed straight into Eloquent's orderBy(),
|
|
* allowing arbitrary SQL expressions in the ORDER BY clause (boolean-based
|
|
* blind injection). Only a plain, optionally table-qualified column
|
|
* identifier is accepted as the sort target; anything containing SQL syntax
|
|
* (parentheses, whitespace, sub-selects, ...) falls back to a safe default.
|
|
* The direction is clamped to asc/desc. Column aliases such as a joined
|
|
* "customers.name" remain valid, so legitimate sorts are unaffected.
|
|
*/
|
|
public static function apply($query, $orderByField, $orderBy = 'desc', string $default = 'created_at')
|
|
{
|
|
$direction = strtolower((string) $orderBy) === 'asc' ? 'asc' : 'desc';
|
|
|
|
$field = is_string($orderByField) ? $orderByField : '';
|
|
|
|
if (! preg_match('/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)?$/', $field)) {
|
|
$field = $default;
|
|
}
|
|
|
|
return $query->orderBy($field, $direction);
|
|
}
|
|
}
|