Problem/Motivation

SA-CORE-2026-004's tests from the private issue have not yet been added to core.

Proposed resolution

Add the tests.

Remaining tasks

NR.

Issue fork drupal-3633176

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

xjm created an issue. See original summary.

xjm’s picture

xjm
she/her
Primary language English
commented
Component: postgresql db driver » entity system
xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Needs review

xjm opened merge request !17565

smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work
Issue tags: +Needs Review Queue Initiative

https://git.drupalcode.org/project/drupal/-/commit/eccc454363a947d3eb71a...
Applied the MR and ran the test testCaseInsensitiveInWithAssociativeArrayKeys() unfortunately it passed without the fix.

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Needs work » Needs review

@smustgrave Did you run it on Postgres? This is a Postgres-only vulnerability.

xjm’s picture

xjm
she/her
Primary language English
commented

Easiest thing to do might be to make an MR that reverts the fix but keep the test, and run the pipeline for that on Postgres. I'll do that.

smustgrave’s picture

smustgrave commented

That's my mistake, I'll try that or I'll setup a ddev one tomorrow.

xjm opened merge request !17618

xjm’s picture

xjm
she/her
Primary language English
commented

There we go:

   PHPUnit 12.5.34 by Sebastian Bergmann and contributors.
    
    Runtime:       PHP 8.5.12
    Configuration: /builds/project/drupal/core/phpunit.xml.dist
    
    .........E.........                                               19 / 19 (100%)
    
    Time: 00:33.277, Memory: 8.00 MB
    
    Entity Query (Drupal\KernelTests\Core\Entity\EntityQuery)
     ✔ Entity query
     ✔ Sort
     ✔ Table sort
     ✔ Count
     ✔ Nested condition groups
     ✔ Condition count
     ✔ Delta
     ✔ Meta data
     ✔ Case sensitivity
     ✘ Case insensitive in with associative array keys
       ┐
       ├ InvalidArgumentException: ; is not supported in SQL strings. Use only one statement at a time.
       │
       │ /builds/project/drupal/core/lib/Drupal/Core/Database/Connection.php:491
       │ /builds/project/drupal/core/lib/Drupal/Core/Database/Connection.php:447
       │ /builds/project/drupal/core/modules/pgsql/src/Driver/Database/pgsql/Connection.php:280
       │ /builds/project/drupal/core/lib/Drupal/Core/Database/Connection.php:675
       │ /builds/project/drupal/core/modules/pgsql/src/Driver/Database/pgsql/Connection.php:255
       │ /builds/project/drupal/core/lib/Drupal/Core/Database/Query/Select.php:528
       │ /builds/project/drupal/core/modules/pgsql/src/Driver/Database/pgsql/Select.php:150
       │ /builds/project/drupal/core/lib/Drupal/Core/Entity/Query/Sql/Query.php:289
       │ /builds/project/drupal/core/lib/Drupal/Core/Entity/Query/Sql/Query.php:85
       │ /builds/project/drupal/core/tests/Drupal/KernelTests/Core/Entity/EntityQueryTest.php:1231
       ┴
     ✔ Base field multiple columns
     ✔ Pending revisions
     ✔ Injection in condition
     ✔ With two entity reference fields to same entity type
     ✔ Alter hook
     ✔ Condition on revision metadata keys
     ✔ Revision data table join uses configured langcode key
     ✔ To string
     ✔ Access check specified
    
    ERRORS!
    Tests: 19, Assertions: 307, Errors: 1.

... on the Postgres pipeline for the FAIL MR.

smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community

Oh nice! Thanks for setting that up!

  • catch committed 5dd5e527 on 11.5.x 
    task: #3633176 Add test coverage for SA-CORE-2026-004

By: xjm
By:...

  • catch committed 9d5f6330 on 11.x 
    task: #3633176 Add test coverage for SA-CORE-2026-004

By: xjm
By:...

  • catch committed 5370e661 on 12.0.x 
    task: #3633176 Add test coverage for SA-CORE-2026-004

By: xjm
By:...

  • catch committed 600ed8e3 on main 
    task: #3633176 Add test coverage for SA-CORE-2026-004

By: xjm
By:...
catch’s picture

catch
he/him
Primary language English
commented
Version: main » 11.5.x-dev
Status: Reviewed & tested by the community » Fixed

Committed/pushed to main and cherry-picked back through to 11.5.x, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • xjm committed 0f4c82b7 on 11.4.x authored by catch 
    task: #3633176 Add test coverage for SA-CORE-2026-004

By: xjm
By:...
xjm’s picture

xjm
she/her
Primary language English
commented
Version: 11.5.x-dev » 11.4.x-dev

I also pushed this to 11.4.x because it's a test for a security issue.