From 5782efa6c09c2a505004ccf24fe2c948d368923b Mon Sep 17 00:00:00 2001 From: Jaanus Sellin Date: Mon, 13 Nov 2023 12:43:12 +0200 Subject: [PATCH] chore: move sort order validation closer to store due to possible SQL injection (#5322) --- .../feature-toggle/feature-toggle-strategies-store.ts | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/lib/features/feature-toggle/feature-toggle-strategies-store.ts b/src/lib/features/feature-toggle/feature-toggle-strategies-store.ts index 3e5a8e8142..0f072bb0dc 100644 --- a/src/lib/features/feature-toggle/feature-toggle-strategies-store.ts +++ b/src/lib/features/feature-toggle/feature-toggle-strategies-store.ts @@ -537,6 +537,9 @@ class FeatureStrategiesStore implements IFeatureStrategiesStore { const normalizedFullTag = tag?.filter((tag) => tag.length === 2); const normalizedHalfTag = tag?.filter((tag) => tag.length === 1).flat(); + const validatedSortOrder = + sortOrder === 'asc' || sortOrder === 'desc' ? sortOrder : 'asc'; + let environmentCount = 1; if (projectId) { const rows = await this.db('project_environments') @@ -702,20 +705,21 @@ class FeatureStrategiesStore implements IFeatureStrategiesStore { type: 'type', lastSeenAt: 'env_last_seen_at', }; + if (sortBy.startsWith('environment:')) { const [, envName] = sortBy.split(':'); query = query .orderByRaw( - `CASE WHEN feature_environments.environment = ? THEN feature_environments.enabled ELSE NULL END ${sortOrder}`, + `CASE WHEN feature_environments.environment = ? THEN feature_environments.enabled ELSE NULL END ${validatedSortOrder}`, [envName], ) .orderBy('created_at', 'asc'); } else if (sortByMapping[sortBy]) { query = query - .orderBy(sortByMapping[sortBy], sortOrder) + .orderBy(sortByMapping[sortBy], validatedSortOrder) .orderBy('created_at', 'asc'); } else { - query = query.orderBy('created_at', sortOrder); + query = query.orderBy('created_at', validatedSortOrder); } const total = await countQuery