DBTNG/EQ condition works inconsistently with arrays

Created on 31 October 2016, almost 8 years ago
Updated 23 May 2023, over 1 year ago

Problem/Motivation

$condition->condition('foobar', [1]);

works.

$condition->condition('foobar', [1, 2]);

doesn't.

Proposed resolution

There are a few options:

  1. Add an exception for array and no operator. At least there are no surprises.
  2. ( automatic IN query support was one of several contributing factors that made SA-CORE-2014-005 easily exploitable. ).

Remaining tasks

Decide.

User interface changes

none

API changes

Improve consistency

Data model changes

none

πŸ› Bug report
Status

Fixed

Version

10.1 ✨

Component
DatabaseΒ  β†’

Last updated less than a minute ago

  • Maintained by
  • πŸ‡³πŸ‡±Netherlands @daffie
Created by

πŸ‡¨πŸ‡¦Canada chx

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡ΊπŸ‡ΈUnited States smustgrave

    FYI please try to include interdiffs, just helps.

    Ran the tests local without the fix and confirmed they failed
    Failed asserting that exception of type "Drupal\Core\Database\InvalidQueryException" is thrown.

    I like the idea of throwing an exception.

    Since this doesn't work I don't think it needs a change record. But will leave for committer to decide that.

  • πŸ‡³πŸ‡±Netherlands daffie

    Back to RTBC.

  • πŸ‡³πŸ‡±Netherlands daffie
  • πŸ‡¦πŸ‡ΊAustralia larowlan πŸ‡¦πŸ‡ΊπŸ.au GMT+10

    This needs a change notice and a release note snippet, as the behaviour change could break sites. And for that reason we'll only commit it to 10.1.x.

    I'll have a go at both.

    Additionally, test providers should use keyed arrays to convey additional information in the case of a fail, that can be fixed on commit though.

  • πŸ‡¦πŸ‡ΊAustralia larowlan πŸ‡¦πŸ‡ΊπŸ.au GMT+10

    I added a change notice and added the behaviour change to the draft release notes.

    • larowlan β†’ committed 330d393e on 10.1.x
      Issue #2823910 by daffie, pwolanin, smustgrave, dawehner, larowlan:...
  • πŸ‡¦πŸ‡ΊAustralia larowlan πŸ‡¦πŸ‡ΊπŸ.au GMT+10

    Fixed on commit

    diff --git a/core/tests/Drupal/KernelTests/Core/Database/SelectTest.php b/core/tests/Drupal/KernelTests/Core/Database/SelectTest.php
    index 621f06c24b4..798b4dc5640 100644
    --- a/core/tests/Drupal/KernelTests/Core/Database/SelectTest.php
    +++ b/core/tests/Drupal/KernelTests/Core/Database/SelectTest.php
    @@ -600,15 +600,15 @@ public function testEmptyInCondition() {
        */
       public function providerNonArrayOperatorWithArrayValueCondition() {
         return [
    -      ['=', '='],
    -      ['>', '>'],
    -      ['<', '<'],
    -      ['>=', '>='],
    -      ['<=', '<='],
    -      ['IS NULL', 'IS NULL'],
    -      ['IS NOT NULL', 'IS NOT NULL'],
    -      ['', '='],
    -      [NULL, '='],
    +      '=' => ['=', '='],
    +      '>' => ['>', '>'],
    +      '<' => ['<', '<'],
    +      '>=' => ['>=', '>='],
    +      '<=' => ['<=', '<='],
    +      'IS NULL' => ['IS NULL', 'IS NULL'],
    +      'IS NOT NULL' => ['IS NOT NULL', 'IS NOT NULL'],
    +      'Empty string' => ['', '='],
    +      'Not set' => [NULL, '='],
         ];
       }
    

    Published the change record

  • πŸ‡¦πŸ‡ΊAustralia larowlan πŸ‡¦πŸ‡ΊπŸ.au GMT+10
  • Automatically closed - issue fixed for 2 weeks with no activity.

  • Status changed to Needs review over 1 year ago
  • πŸ‡ΊπŸ‡ΈUnited States neclimdul Houston, TX

    I'm that person who's site was broken. I have a view argument that works in 10.0 but throws this exception in 10.1. Wouldn't that sort of behavior normally be deprecated instead of break sites on a minor release?

    Compromise, if count > 1, throw exception, else trigger deprecation?

  • Open on Drupal.org β†’
    Environment: PHP 8.1 & MySQL 5.7
    last update over 1 year ago
    Waiting for branch to pass
  • πŸ‡ΊπŸ‡ΈUnited States neclimdul Houston, TX

    Patch with the deprecation middle ground.

  • πŸ‡ΊπŸ‡ΈUnited States neclimdul Houston, TX

    trying to fix the regression and provide a proper deprecation in 10.1.

  • πŸ‡¨πŸ‡¦Canada Charlie ChX Negyesi 🍁Canada

    Add back automated IN support. ( automatic IN query support was one of several contributing factors that made SA-CORE-2014-005 easily exploitable. ).

    That was in query and it is no reason to cripple the query builder. There was no need to do that then or now. We have added more Drupalisms and degraded DX for no reason whatsoever. The job of the query builder is to do the sensible thing and it can easily do so seeing an array. It's much harder for the string thing.

  • Status changed to RTBC over 1 year ago
  • πŸ‡¬πŸ‡§United Kingdom catch

    Since removing automatic IN() support didn't happen in this issue, putting it back should be its own issue rather than keeping going in this one.

    I do think the main issue with SA-CORE-2014-005 was committing patches from needs work at midnight on Christmas eve more than trying to support array expansion as such.

    #52 looks good to me. I wonder a bit if we want to trigger_error() E_USER_WARNING when count > 1 too, but if there are no known cases of this being relied upon, the exception is still clearer.

    • larowlan β†’ committed 485604fe on 11.x
      Issue #2823910 by daffie, pwolanin, smustgrave, neclimdul, larowlan,...
    • larowlan β†’ committed 7e1dcd65 on 10.1.x
      Issue #2823910 by daffie, pwolanin, smustgrave, neclimdul, larowlan,...
  • Status changed to Fixed over 1 year ago
  • πŸ‡¦πŸ‡ΊAustralia larowlan πŸ‡¦πŸ‡ΊπŸ.au GMT+10

    Committed and pushed to 11.x and cherry-picked to 10.1.x

    Thanks for testing the new release before it comes out @neclimdul πŸ’ͺ

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024