Skip to content

Commit 4ff4011

Browse files
crynobonecrynobone
committed
Fixes whereDate, whereDay, whereMonth, whereTime, whereYear and whereJsonLength to ignore invalid $operator
Signed-off-by: Mior Muhammad Zaki <crynobone@gmail.com>
1 parent 05a9554 commit 4ff4011

File tree

3 files changed

+238
-1
lines changed

3 files changed

+238
-1
lines changed

‎src/Illuminate/Database/DBAL/TimestampType.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@
44

55
use Doctrine\DBAL\Exception as DBALException;
66
use Doctrine\DBAL\Platforms\AbstractPlatform;
7+
use Doctrine\DBAL\Platforms\MariaDb1010Platform;
78
use Doctrine\DBAL\Platforms\MariaDb1027Platform;
89
use Doctrine\DBAL\Platforms\MariaDb1052Platform;
910
use Doctrine\DBAL\Platforms\MariaDb1060Platform;
1011
use Doctrine\DBAL\Platforms\MariaDBPlatform;
1112
use Doctrine\DBAL\Platforms\MySQL57Platform;
1213
use Doctrine\DBAL\Platforms\MySQL80Platform;
14+
use Doctrine\DBAL\Platforms\MySQL84Platform;
1315
use Doctrine\DBAL\Platforms\MySQLPlatform;
1416
use Doctrine\DBAL\Platforms\PostgreSQL100Platform;
1517
use Doctrine\DBAL\Platforms\PostgreSQL94Platform;
@@ -33,10 +35,12 @@ public function getSQLDeclaration(array $column, AbstractPlatform $platform): st
3335
MySQLPlatform::class,
3436
MySQL57Platform::class,
3537
MySQL80Platform::class,
38+
MySQL84Platform::class,
3639
MariaDBPlatform::class,
3740
MariaDb1027Platform::class,
3841
MariaDb1052Platform::class,
39-
MariaDb1060Platform::class => $this->getMySqlPlatformSQLDeclaration($column),
42+
MariaDb1060Platform::class,
43+
MariaDb1010Platform::class => $this->getMySqlPlatformSQLDeclaration($column),
4044
PostgreSQLPlatform::class,
4145
PostgreSQL94Platform::class,
4246
PostgreSQL100Platform::class => $this->getPostgresPlatformSQLDeclaration($column),

‎src/Illuminate/Database/Query/Builder.php‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1436,6 +1436,13 @@ public function whereDate($column, $operator, $value = null, $boolean = 'and')
14361436
$value, $operator, func_num_args() === 2
14371437
);
14381438

1439+
// If the given operator is not found in the list of valid operators we will
1440+
// assume that the developer is just short-cutting the '=' operators and
1441+
// we will set the operators to '=' and set the values appropriately.
1442+
if ($this->invalidOperator($operator)) {
1443+
[$value, $operator] = [$operator, '='];
1444+
}
1445+
14391446
$value = $this->flattenValue($value);
14401447

14411448
if ($value instanceof DateTimeInterface) {
@@ -1477,6 +1484,13 @@ public function whereTime($column, $operator, $value = null, $boolean = 'and')
14771484
$value, $operator, func_num_args() === 2
14781485
);
14791486

1487+
// If the given operator is not found in the list of valid operators we will
1488+
// assume that the developer is just short-cutting the '=' operators and
1489+
// we will set the operators to '=' and set the values appropriately.
1490+
if ($this->invalidOperator($operator)) {
1491+
[$value, $operator] = [$operator, '='];
1492+
}
1493+
14801494
$value = $this->flattenValue($value);
14811495

14821496
if ($value instanceof DateTimeInterface) {
@@ -1518,6 +1532,13 @@ public function whereDay($column, $operator, $value = null, $boolean = 'and')
15181532
$value, $operator, func_num_args() === 2
15191533
);
15201534

1535+
// If the given operator is not found in the list of valid operators we will
1536+
// assume that the developer is just short-cutting the '=' operators and
1537+
// we will set the operators to '=' and set the values appropriately.
1538+
if ($this->invalidOperator($operator)) {
1539+
[$value, $operator] = [$operator, '='];
1540+
}
1541+
15211542
$value = $this->flattenValue($value);
15221543

15231544
if ($value instanceof DateTimeInterface) {
@@ -1563,6 +1584,13 @@ public function whereMonth($column, $operator, $value = null, $boolean = 'and')
15631584
$value, $operator, func_num_args() === 2
15641585
);
15651586

1587+
// If the given operator is not found in the list of valid operators we will
1588+
// assume that the developer is just short-cutting the '=' operators and
1589+
// we will set the operators to '=' and set the values appropriately.
1590+
if ($this->invalidOperator($operator)) {
1591+
[$value, $operator] = [$operator, '='];
1592+
}
1593+
15661594
$value = $this->flattenValue($value);
15671595

15681596
if ($value instanceof DateTimeInterface) {
@@ -1608,6 +1636,13 @@ public function whereYear($column, $operator, $value = null, $boolean = 'and')
16081636
$value, $operator, func_num_args() === 2
16091637
);
16101638

1639+
// If the given operator is not found in the list of valid operators we will
1640+
// assume that the developer is just short-cutting the '=' operators and
1641+
// we will set the operators to '=' and set the values appropriately.
1642+
if ($this->invalidOperator($operator)) {
1643+
[$value, $operator] = [$operator, '='];
1644+
}
1645+
16111646
$value = $this->flattenValue($value);
16121647

16131648
if ($value instanceof DateTimeInterface) {
@@ -1974,6 +2009,13 @@ public function whereJsonLength($column, $operator, $value = null, $boolean = 'a
19742009
$value, $operator, func_num_args() === 2
19752010
);
19762011

2012+
// If the given operator is not found in the list of valid operators we will
2013+
// assume that the developer is just short-cutting the '=' operators and
2014+
// we will set the operators to '=' and set the values appropriately.
2015+
if ($this->invalidOperator($operator)) {
2016+
[$value, $operator] = [$operator, '='];
2017+
}
2018+
19772019
$this->wheres[] = compact('type', 'column', 'operator', 'value', 'boolean');
19782020

19792021
if (! $value instanceof ExpressionContract) {

‎tests/Integration/Database/QueryBuilderTest.php‎

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
use Illuminate\Support\Carbon;
1010
use Illuminate\Support\Facades\DB;
1111
use Illuminate\Support\Facades\Schema;
12+
use Illuminate\Testing\Assert as PHPUnit;
1213

1314
class QueryBuilderTest extends DatabaseTestCase
1415
{
@@ -305,66 +306,256 @@ public function testWhereDate()
305306
$this->assertSame(1, DB::table('posts')->whereDate('created_at', new Carbon('2018-01-02'))->count());
306307
}
307308

309+
public function testWhereDateWithInvalidOperator()
310+
{
311+
$sql = DB::table('posts')->whereDate('created_at', '? OR 1=1', '2018-01-02');
312+
313+
PHPUnit::assertArraySubset([
314+
[
315+
'column' => 'created_at',
316+
'type' => 'Date',
317+
'value' => '? OR 1=1',
318+
'boolean' => 'and',
319+
],
320+
], $sql->wheres);
321+
322+
$this->assertSame(0, $sql->count());
323+
}
324+
308325
public function testOrWhereDate()
309326
{
310327
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereDate('created_at', '2018-01-02')->count());
311328
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereDate('created_at', new Carbon('2018-01-02'))->count());
312329
}
313330

331+
public function testOrWhereDateWithInvalidOperator()
332+
{
333+
$sql = DB::table('posts')->where('id', 1)->orWhereDate('created_at', '? OR 1=1', '2018-01-02');
334+
335+
PHPUnit::assertArraySubset([
336+
[
337+
'column' => 'id',
338+
'type' => 'Basic',
339+
'value' => 1,
340+
'boolean' => 'and',
341+
],
342+
[
343+
'column' => 'created_at',
344+
'type' => 'Date',
345+
'value' => '? OR 1=1',
346+
'boolean' => 'or',
347+
],
348+
], $sql->wheres);
349+
350+
$this->assertSame(1, $sql->count());
351+
}
352+
314353
public function testWhereDay()
315354
{
316355
$this->assertSame(1, DB::table('posts')->whereDay('created_at', '02')->count());
317356
$this->assertSame(1, DB::table('posts')->whereDay('created_at', 2)->count());
318357
$this->assertSame(1, DB::table('posts')->whereDay('created_at', new Carbon('2018-01-02'))->count());
319358
}
320359

360+
public function testWhereDayWithInvalidOperator()
361+
{
362+
$sql = DB::table('posts')->whereDay('created_at', '? OR 1=1', '02');
363+
364+
PHPUnit::assertArraySubset([
365+
[
366+
'column' => 'created_at',
367+
'type' => 'Day',
368+
'value' => '00',
369+
'boolean' => 'and',
370+
],
371+
], $sql->wheres);
372+
373+
$this->assertSame(0, $sql->count());
374+
}
375+
321376
public function testOrWhereDay()
322377
{
323378
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereDay('created_at', '02')->count());
324379
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereDay('created_at', 2)->count());
325380
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereDay('created_at', new Carbon('2018-01-02'))->count());
326381
}
327382

383+
public function testOrWhereDayWithInvalidOperator()
384+
{
385+
$sql = DB::table('posts')->where('id', 1)->orWhereDay('created_at', '? OR 1=1', '02');
386+
387+
PHPUnit::assertArraySubset([
388+
[
389+
'column' => 'id',
390+
'type' => 'Basic',
391+
'value' => 1,
392+
'boolean' => 'and',
393+
],
394+
[
395+
'column' => 'created_at',
396+
'type' => 'Day',
397+
'value' => '00',
398+
'boolean' => 'or',
399+
],
400+
], $sql->wheres);
401+
402+
$this->assertSame(1, $sql->count());
403+
}
404+
328405
public function testWhereMonth()
329406
{
330407
$this->assertSame(1, DB::table('posts')->whereMonth('created_at', '01')->count());
331408
$this->assertSame(1, DB::table('posts')->whereMonth('created_at', 1)->count());
332409
$this->assertSame(1, DB::table('posts')->whereMonth('created_at', new Carbon('2018-01-02'))->count());
333410
}
334411

412+
public function testWhereMonthWithInvalidOperator()
413+
{
414+
$sql = DB::table('posts')->whereMonth('created_at', '? OR 1=1', '01');
415+
416+
PHPUnit::assertArraySubset([
417+
[
418+
'column' => 'created_at',
419+
'type' => 'Month',
420+
'value' => '00',
421+
'boolean' => 'and',
422+
],
423+
], $sql->wheres);
424+
425+
$this->assertSame(0, $sql->count());
426+
}
427+
335428
public function testOrWhereMonth()
336429
{
337430
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereMonth('created_at', '01')->count());
338431
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereMonth('created_at', 1)->count());
339432
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereMonth('created_at', new Carbon('2018-01-02'))->count());
340433
}
341434

435+
public function testOrWhereMonthWithInvalidOperator()
436+
{
437+
$sql = DB::table('posts')->where('id', 1)->orWhereMonth('created_at', '? OR 1=1', '01');
438+
439+
PHPUnit::assertArraySubset([
440+
[
441+
'column' => 'id',
442+
'type' => 'Basic',
443+
'value' => 1,
444+
'boolean' => 'and',
445+
],
446+
[
447+
'column' => 'created_at',
448+
'type' => 'Month',
449+
'value' => '00',
450+
'boolean' => 'or',
451+
],
452+
], $sql->wheres);
453+
454+
$this->assertSame(1, $sql->count());
455+
}
456+
342457
public function testWhereYear()
343458
{
344459
$this->assertSame(1, DB::table('posts')->whereYear('created_at', '2018')->count());
345460
$this->assertSame(1, DB::table('posts')->whereYear('created_at', 2018)->count());
346461
$this->assertSame(1, DB::table('posts')->whereYear('created_at', new Carbon('2018-01-02'))->count());
347462
}
348463

464+
public function testWhereYearWithInvalidOperator()
465+
{
466+
$sql = DB::table('posts')->whereYear('created_at', '? OR 1=1', '2018');
467+
468+
PHPUnit::assertArraySubset([
469+
[
470+
'column' => 'created_at',
471+
'type' => 'Year',
472+
'value' => '? OR 1=1',
473+
'boolean' => 'and',
474+
],
475+
], $sql->wheres);
476+
477+
$this->assertSame(0, $sql->count());
478+
}
479+
349480
public function testOrWhereYear()
350481
{
351482
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereYear('created_at', '2018')->count());
352483
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereYear('created_at', 2018)->count());
353484
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereYear('created_at', new Carbon('2018-01-02'))->count());
354485
}
355486

487+
public function testOrWhereYearWithInvalidOperator()
488+
{
489+
$sql = DB::table('posts')->where('id', 1)->orWhereYear('created_at', '? OR 1=1', '2018');
490+
491+
PHPUnit::assertArraySubset([
492+
[
493+
'column' => 'id',
494+
'type' => 'Basic',
495+
'value' => 1,
496+
'boolean' => 'and',
497+
],
498+
[
499+
'column' => 'created_at',
500+
'type' => 'Year',
501+
'value' => '? OR 1=1',
502+
'boolean' => 'or',
503+
],
504+
], $sql->wheres);
505+
506+
$this->assertSame(1, $sql->count());
507+
}
508+
356509
public function testWhereTime()
357510
{
358511
$this->assertSame(1, DB::table('posts')->whereTime('created_at', '03:04:05')->count());
359512
$this->assertSame(1, DB::table('posts')->whereTime('created_at', new Carbon('2018-01-02 03:04:05'))->count());
360513
}
361514

515+
public function testWhereTimeWithInvalidOperator()
516+
{
517+
$sql = DB::table('posts')->whereTime('created_at', '? OR 1=1', '03:04:05');
518+
519+
PHPUnit::assertArraySubset([
520+
[
521+
'column' => 'created_at',
522+
'type' => 'Time',
523+
'value' => '? OR 1=1',
524+
'boolean' => 'and',
525+
],
526+
], $sql->wheres);
527+
528+
$this->assertSame(0, $sql->count());
529+
}
530+
362531
public function testOrWhereTime()
363532
{
364533
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereTime('created_at', '03:04:05')->count());
365534
$this->assertSame(2, DB::table('posts')->where('id', 1)->orWhereTime('created_at', new Carbon('2018-01-02 03:04:05'))->count());
366535
}
367536

537+
public function testOrWhereTimeWithInvalidOperator()
538+
{
539+
$sql = DB::table('posts')->where('id', 1)->orWhereTime('created_at', '? OR 1=1', '03:04:05');
540+
541+
PHPUnit::assertArraySubset([
542+
[
543+
'column' => 'id',
544+
'type' => 'Basic',
545+
'value' => 1,
546+
'boolean' => 'and',
547+
],
548+
[
549+
'column' => 'created_at',
550+
'type' => 'Time',
551+
'value' => '? OR 1=1',
552+
'boolean' => 'or',
553+
],
554+
], $sql->wheres);
555+
556+
$this->assertSame(1, $sql->count());
557+
}
558+
368559
public function testWhereNested()
369560
{
370561
$results = DB::table('posts')->where('content', 'Lorem Ipsum.')->whereNested(function ($query) {

0 commit comments

Comments
 (0)