orderby() should verify direction [DONE] and escape fields

Created on 16 June 2010, almost 15 years ago

Updated 19 March 2025, 18 days ago

In my dream (where unicorns also roam) DBTNG goes out of its way to prevent SQL injections due to silly mistakes, or a moment of carelessness.

orderby() doesn't escape fields / aliases and does not check $direction, allowing SQL injection when developers pass usersupplied data.

idem for group by, though that needs further study.

🐛 Bug report

Status

Needs work

Version

7.0 ⚰️

Component

database system

Created by

🇳🇱Netherlands heine

Live updates comments and jobs are added and updated live.

Security improvements
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

Needs backport to D7
After being applied to the 8.x branch, it should be considered for backport to the 7.x branch. Note: This tag should generally remain even after the backport has been written, approved, and committed.

Incomplete comments

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Comment 18 days ago →
🇺🇸United States kentr Durango, CO
Is this what remains to be done?

Apply changes in patch from #68 to 11.x

Incorporate review comments in #82

Create an MR
Comment 16 days ago →
🇺🇸United States luke.leber Pennsylvania
Rather doubtful anything will happen with this as it's a Drupal 7 issue. Seems to have been committed to 8+ already.
Comment 16 days ago →
🇺🇸United States greggles Denver, Colorado, USA
Agreed with #87. All of the concept was committed to 8.x. Some of it was fixed in 7.x (in #58).

So marking this as fixed with a version of 8.4.x.
Comment 1 day ago →
System Message
Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024