SQL injection via unvalidated operator in case-insensitive entity query array conditions

This was originally reported as a private security issue, but has been approved for handling in the public queue by the Drupal Security Team as "it is a known issue in public since 2015 that the $operator parameter to ->condition() is a potential sink from this issue".

Background information

• security.drupal.org private issue: https://git.drupalcode.org/security/185198-drupal-security/-/work_items/1 (included for reference. Please do not report access denied as an error.)

Problem/Motivation

The vulnerability is in web/core/modules/pgsql/src/EntityQuery/Condition.php line 18.
$condition['operator'] is raw string-concatenated into SQL. ConditionBase::condition() stores the operator with no validation. The base Sql\Condition::translateCondition() returns early for array values (line 115-116 of the base class), so no validation occurs upstream either. The field is properly escaped via escapeField() and values are parameterized, but the operator is unguarded.

Affected

PostgreSQL only. Requires a caller that passes untrusted input as the operator argument to an entity query condition on a case-insensitive field with an array value.
Not directly triggerable from Drupal core alone, but exploitable via contrib modules that expose this pattern.

Steps to reproduce

Described in the original private issue.

Proposed resolution

Add an operator whitelist before the SQL construction:

if (!in_array($condition['operator'], ['IN', 'NOT IN'], TRUE)) {
  throw new \InvalidArgumentException(sprintf('Invalid operator "%s" for a case-insensitive array condition.', $condition['operator']));
}

Remaining tasks

• Provide a merge request with the fix and tests

User interface changes

none

Introduced terminology

none

API changes

none

Data model changes

none

Release notes snippet

The PostgreSQL entity query condition operator is now validated against an allowlist to prevent potential SQL injection.

Credit

• macsim
• larowlan
• greggles