Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix: tighten function check in validate_order_by_and_group_by (backport #33100) #33245

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 7, 2025
Merged

fix: tighten function check in validate_order_by_and_group_by (backport #33100) #33245

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
12c1f8d
fix: tighten function check in `validate_order_by_and_group_by`
akhilnarang Jun 25, 2025
2c3770e
fix(db_query): don't allow unclosed quotes
akhilnarang Jul 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions frappe/model/db_query.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1112,8 +1112,9 @@ def validate_order_by_and_group_by(self, parameters: str):
frappe.throw(_("Illegal SQL Query"))

for field in parameters.split(","):
if field.count('"') % 2 or field.count("'") % 2 or field.count("`") % 2:
frappe.throw(_("Invalid field name: {0}").format(field))
field = field.strip()
function = field.split("(", 1)[0].rstrip().lower()
full_field_name = "." in field and field.startswith("`tab")

if full_field_name:
Expand All @@ -1123,9 +1124,10 @@ def validate_order_by_and_group_by(self, parameters: str):
tbl = tbl[4:-1]
frappe.throw(_("Please select atleast 1 column from {0} to sort/group").format(tbl))

# Check if the function is used anywhere in the field
if any(func in function for func in blacklisted_sql_functions):
frappe.throw(_("Cannot use {0} in order/group by").format(function))
# Check for SQL function using regex with word boundaries and optional whitespace before parenthesis
for func in blacklisted_sql_functions:
if re.search(r"\b" + re.escape(func) + r"\s*\(", field.lower()):
frappe.throw(_("Cannot use {0} in order/group by").format(field))

def add_limit(self):
if self.limit_page_length:
Expand Down
Loading