Vateron-Media/XC_VM
1
0
Fork 0
mirror of https://github.com/Vateron-Media/XC_VM.git synced 2026-10-24 04:03:11 +02:00
Code Issues Packages Projects Releases 6 Wiki Activity

fix(security): confirmIDs returns the integers it checked

Browse Source 
InputValidator::confirmIDs() kept an id when intval($id) > 0 but returned
the original value, and its callers implode the result into SQL `IN (...)`
lists (mass edit and delete of lines, users, streams, series; bouquet
contents; global search). '1) OR (1=1' has an intval of 1, so it passed the
filter and reached the query unchanged. It now returns the integers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V2uBUbGApb4A7Rbcoi7dxA
This commit is contained in:
root
2026-09-17 07:45:48 +00:00
co-authored by Claude Opus 5
parent 99036f99d0
commit 0d06fff983
2 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/InputValidatorTest.php
+10
View File
@@ -28,4 +28,14 @@ final class InputValidatorTest extends TestCase {
$result = InputValidator::validateOrFail('processProvider', array('ip' => '127.0.0.1'));
$this->assertSame(STATUS_INVALID_INPUT, $result['status']);
}
/**
* Callers implode the result straight into `IN (...)`, so what comes back
* must be the integers, not the strings that merely start with one.
*/
public function testConfirmIdsReturnsIntegers() {
$this->assertSame([5, 12], InputValidator::confirmIDs(['5', '0', '-3', 'abc', '12']));
$this->assertSame([1], InputValidator::confirmIDs(['1) OR (1=1']));
$this->assertSame([7], InputValidator::confirmIDs([7]));
}
}