The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Problem/Motivation
As a follow-up to https://www.drupal.org/project/drupal/issues/3605792 add SQLi protection to /core/lib/Drupal/Core/Entity/Query/Sql/pgsql/Condition.php
This can be done in public, same as that issue was; it's mostly a hardening to ensure consistency and avoid reports by security code scanners identifying this deprecated class as a remaining vector for SA-CORE-2026-004 or similar.
Analysis suggests that the missing fixes in the deprecated class would only really be a problem in two quite unlikely scenarios:
- A pgsql site that's upgraded but somehow not enabled the pqsql module (
system_post_update_enable_provider_database_driver()would have had to fail to do its job somehow). See: https://git.drupalcode.org/project/drupal/-/blob/11.4.4/core/modules/sys... - Custom or contrib code somehow calling the deprecated code directly.
The deprecated class was removed in D12.
Issue fork drupal-3614837
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
compare
Comments
Comment #3
mcdruid commentedTests passing in the MR.
Comment #4
daffie commentedIs the same fix as in the main branch.
Comment #8
longwaveBackported down to 11.3.x as a security fix as that branch still receives security support. 10.6.x already has this in place (because it only has the old driver).
Committed and pushed daaad28aba6 to 11.x and 9230bcecc30 to 11.4.x and 002ac383019 to 11.3.x. Thanks!