vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge pull request #32231 from akhilnarang/stricter-field-validation

Browse source 
fix: stricter field validation
This commit is contained in:
Akhil Narang 2025-04-22 13:39:21 +05:30 • committed by GitHub
commit 965728cd9b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
frappe/model/db_query.py
View file

@ -38,7 +38,7 @@ LOCATE_CAST_PATTERN = re.compile(r"locate\(([^,]+),\s*([`\"]?name[`\"]?)\s*\)",
FUNC_IFNULL_PATTERN = re.compile(r"(strpos|ifnull|coalesce)\(\s*[`\"]?name[`\"]?\s*,", flags=re.IGNORECASE)
CAST_VARCHAR_PATTERN = re.compile(r"([`\"]?tab[\w`\" -]+\.[`\"]?name[`\"]?)(?!\w)", flags=re.IGNORECASE)
ORDER_BY_PATTERN = re.compile(r"\ order\ by\ |\ asc|\ ASC|\ desc|\ DESC", flags=re.IGNORECASE)
SUB_QUERY_PATTERN = re.compile("^.*[,();@].*")
SUB_QUERY_PATTERN = re.compile("^.*[,();@].*", flags=re.DOTALL)
IS_QUERY_PATTERN = re.compile(r"^(select|delete|update|drop|create)\s")
IS_QUERY_PREDICATE_PATTERN = re.compile(r"\s*[0-9a-zA-z]*\s*( from | group by | order by | where | join )")
FIELD_QUOTE_PATTERN = re.compile(r"[0-9a-zA-Z]+\s*'")
@ -421,9 +421,11 @@ class DatabaseQuery:
lower_field = field.lower().strip()
if SUB_QUERY_PATTERN.match(field):
if lower_field[0] == "(":
subquery_token = lower_field[1:].lstrip().split(" ", 1)[0]
if subquery_token in blacklisted_keywords:
# Check for subquery anywhere in the field, not just at the beginning
if "(" in lower_field:
location = lower_field.index("(")
subquery_token = lower_field[location + 1 :].lstrip().split(" ", 1)[0]
if any(keyword in subquery_token for keyword in blacklisted_keywords):
_raise_exception()
function = lower_field.split("(", 1)[0].rstrip()