Problem/Motivation

Entity QueryAggregate does not escape the field that is argument of the aggregation function.

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#5 3190285-5-test-only.patch944 bytesmondrake

Issue fork drupal-3190285

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

mondrake created an issue. See original summary.

larowlan’s picture

Should this be a private issue?

larowlan’s picture

Unpublished just in case

mondrake’s picture

@larowlan no I don't think so, this is a database portability issue, not a security related one

mondrake’s picture

StatusFileSize
new944 bytes

Test only patch.

mondrake’s picture

Issue summary: View changes
larowlan’s picture

mondrake’s picture

mondrake’s picture

mondrake’s picture

Status: Active » Needs review

So, the test in #5 has nothing to do with the issue here, as it releates to queries generated by views and not by the entity system.

The latest MR, though, allows EntityQueryAggregateTest to pass successfully on Oracle.

mondrake’s picture

Title: entityQueryAggregate does not escape the field » Entity QueryAggregate does not escape the field
mondrake’s picture

mondrake’s picture

Issue summary: View changes
daffie’s picture

Status: Needs review » Needs work

@mondrake: The pacth looks good, just one remark.

anmolgoyal74 made their first commit to this issue’s fork.

anmolgoyal74’s picture

Status: Needs work » Needs review
daffie’s picture

Status: Needs review » Reviewed & tested by the community

The patch looks great to me.
For me it is RTBC.

mondrake’s picture

Status: Reviewed & tested by the community » Needs review

I have a failure in testing my DruDbal contrib driver when using the latest MR, due to mismatching quote identifiers. IMHO we should go back to just check that 'an' identifier is present, not hardcoding the SELECT.

daffie’s picture

@mondrake: Could you change the test, so that it also passes for your DruDbal driver?

mondrake’s picture

@daffie it was passing before the last change

daffie’s picture

I would very much like to test on the identifierQuotes from the connection class. Testing on '\(.entity_test.\..id.\) AS .id_' is not ver clear to me. For me the problem with the regexp assertion is that regexp sees double quotes as special characters. Therefore an assertStringContainsString() would be better.

What are the values of $start_quote and $end_quote for your DruDbal driver? If they are empty/not set could we make double quotes their default values? Would that work for your driver?

If we remove the 'SELECT' part from my variable $expected_query_part, would that work for your DruDbal driver?

mondrake’s picture

In DruDbal the identifierQuotes are not fixed - they're dependent on the actual DBMS doctrine/dbal connects to - from backtick in MySql to double quote in SQLite and Oracle.

I do not think we should test the identifierQuotes in this test - if need be, I'd rather go for a separate, independent test of its own.

The dot in the regex is there to mean 'is there any character in this position', so for me it's OK since we need to ensure that e.g.

max([entity_test].[id]) AS [id_max]

is converted to

max("entity_test"."id") AS "id_max" or
max(`entity_test`.`id`) AS `id_max` or
max('entity_test'.'id') AS 'id_max'

i.e. that at least a character exist before and after the table, column and alias identifiers - which is not the case currently.

daffie’s picture

Status: Needs review » Needs work

@mondrake: OK, lets go with your solution. Could you add a comment with your explanation from comment #23 to the regexp test in the patch.

mondrake’s picture

Assigned: Unassigned » mondrake

on it

mondrake’s picture

Assigned: mondrake » Unassigned
Status: Needs work » Needs review

Done, thanks!

mondrake’s picture

Two separate random test failures in a row...

daffie’s picture

Status: Needs review » Reviewed & tested by the community

It all looks good to me.
For me it is RTBC.

mondrake’s picture

Fixed @catch's nit. Please change the status of the issue or at least add a comment to the issue when adding comment to the PR, ATM these are not refreshing the timestamp and are not visible from the issue queue - you really need to get into the issue and MR to notice them.

  • catch committed d99b12f on 9.2.x
    Issue #3190285 by mondrake, anmolgoyal74, daffie: Entity QueryAggregate...

  • catch committed 9116b23 on 9.1.x
    Issue #3190285 by mondrake, anmolgoyal74, daffie: Entity QueryAggregate...
catch’s picture

Version: 9.2.x-dev » 9.1.x-dev
Status: Reviewed & tested by the community » Fixed

Thanks for fixing the nit.

Committed/pushed to 9.2.x and cherry-picked to 9.1.x, thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.