Changeset 9073

Timestamp:

10/08/2014 02:14:29 PM (10 years ago)

Author:

boonebgorges

Message:

Better detection for false positives in meta SQL filters.

Our wrappers for WP's _metadata() functions require some filtering of the SQL
string (to change a column name and, in the case of xprofile, to add an
'object_type' clause). Our str_replace() logic is too generous, creating the
possibility of matching quoted text, as when the meta value contains the string
'WHERE'.

This changeset modifies the filters so that quoted content is swapped out with
placeholders before we run our search-and-replace.

See #5919.
Props tometzky for feedback.

Location:

trunk

Files:

• src/bp-core/bp-core-filters.php (modified) (1 diff)
• src/bp-xprofile/bp-xprofile-filters.php (modified) (3 diffs)
• tests/phpunit/testcases/xprofile/functions.php (modified) (1 diff)

trunk/src/bp-core/bp-core-filters.php

@@ -604 +604 @@
  */
 function bp_filter_metaid_column_name( $q ) {
-    return str_replace( 'meta_id', 'id', $q );
+    /*
+     * Replace quoted content with __QUOTE__ to avoid false positives.
+     * This regular expression will match nested quotes.
+     */
+    $quoted_regex = "/'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'/s";
+    preg_match_all( $quoted_regex, $q, $quoted_matches );
+    $q = preg_replace( $quoted_regex, '__QUOTE__', $q );
+
+    $q = str_replace( 'meta_id', 'id', $q );
+
+    // Put quoted content back into the string.
+    if ( ! empty( $quoted_matches[0] ) ) {
+        for ( $i = 0; $i < count( $quoted_matches[0] ); $i++ ) {
+            $quote_pos = strpos( $q, '__QUOTE__' );
+            $q = substr_replace( $q, $quoted_matches[0][ $i ], $quote_pos, 9 );
+        }
+    }
+
+    return $q;
 }
 

trunk/src/bp-xprofile/bp-xprofile-filters.php

@@ -336 +336 @@
     global $wpdb;
 
+    $raw_q = $q;
+
+    /*
+     * Replace quoted content with __QUOTE__ to avoid false positives.
+     * This regular expression will match nested quotes.
+     */
+    $quoted_regex = "/'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'/s";
+    preg_match_all( $quoted_regex, $q, $quoted_matches );
+    $q = preg_replace( $quoted_regex, '__QUOTE__', $q );
+
     // Get the first word of the command
     preg_match( '/^(\S+)/', $q, $first_word_matches );
 
     if ( empty( $first_word_matches[0] ) ) {
-        return $q;
+        return $raw_q;
     }
 
@@ -347 +357 @@
 
     if ( empty( $matches[0] ) || empty( $matches[1] ) ) {
-        return $q;
+        return $raw_q;
     }
 
@@ -416 +426 @@
     }
 
+    // Put quoted content back into the string.
+    if ( ! empty( $quoted_matches[0] ) ) {
+        for ( $i = 0; $i < count( $quoted_matches[0] ); $i++ ) {
+            $quote_pos = strpos( $q, '__QUOTE__' );
+            $q = substr_replace( $q, $quoted_matches[0][ $i ], $quote_pos, 9 );
+        }
+    }
+
     return $q;
 }

trunk/tests/phpunit/testcases/xprofile/functions.php

@@ -474 +474 @@
     /**
      * @group xprofilemeta
+     * @group bp_xprofile_update_meta
+     * @ticket BP5919
+     */
+    public function test_bp_xprofile_update_meta_where_sql_filter_keywords_are_in_quoted_value() {
+        $g = $this->factory->xprofile_group->create();
+        $value = "SELECT object_id FROM wp_bp_xprofile_groups WHERE \"foo\" VALUES (foo = 'bar'";
+        bp_xprofile_add_meta( $g, 'group', 'foo', 'bar' );
+        bp_xprofile_update_meta( $g, 'group', 'foo', $value );
+        $this->assertSame( $value, bp_xprofile_get_meta( $g, 'group', 'foo' ) );
+    }
+
+    /**
+     * @group xprofilemeta
+     * @group bp_xprofile_update_meta
+     * @ticket BP5919
+     */
+    public function test_bp_xprofile_update_meta_where_meta_id_is_in_quoted_value() {
+        $g = $this->factory->xprofile_group->create();
+        $value = "foo meta_id bar";
+        bp_xprofile_add_meta( $g, 'group', 'foo', 'bar' );
+        bp_xprofile_update_meta( $g, 'group', 'foo', $value );
+        $this->assertSame( $value, bp_xprofile_get_meta( $g, 'group', 'foo' ) );
+    }
+
+    /**
+     * @group xprofilemeta
      * @group bp_xprofile_add_meta
      */