SOQL queries do not work like typical Drupal db queries, in that they are not sanitized before issuing.

This is generally not a security issue, because any contrib which has access to implement Drupal hooks already has access to issue any arbitrary SOQL query. However, it has been suggested that sanitization to move towards feature parity with Drupal's db layer would be useful.

CommentFileSizeAuthor
#3 sanitize-values-2866367-3-d8.patch3.08 KBacrosman

Comments

aaronbauman created an issue. See original summary.

acrosman’s picture

acrosman
Primary language English
Location South Carolina, US
commented

I think the escaping could happen during __toString() to avoid any BC issues and ensure all query values were checked, although for the sake of consistency it would be nice to have a parent class of both SelectQuery and SelectQueryRaw that provided a sanitizing utility function that could be used by module developers who need to write a raw query.

I'll try to get together a D8 patch.

acrosman’s picture

acrosman
Primary language English
Location South Carolina, US
commented
Status: Active » Needs review
StatusFileSize
new sanitize-values-2866367-3-d8.patch3.08 KB

Patch (D8 only) adds a base class that provides a sanitizing function the other two existing classes extend that class and the base class implements the existing interface. Raw queries and query conditions provided as strings are not sanitized, but conditions that are structured as field, operator, and value arrays sanitize the value.

aaronbauman’s picture

aaronbauman
he/him
commented
Status: Needs review » Fixed

I guess there are *possible* but very unlikely BC issues here, but probably negligible.
Thanks for the patch!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.