fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merged in bugfix/PMCORE-2324 (pull request #7521)

Browse Source 
PMCORE-2324 SQL Injection via 'Category' parameter in proxyNewCasesList endpoint

Approved-by: Julio Cesar Laura Avendaño <contact@julio-laura.com>
This commit is contained in:
Roly Rudy Gutierrez Pinto
2020-10-16 13:43:20 +00:00
committed by Julio Cesar Laura Avendaño
parent daffb4451d 8a306f38d4
commit 64a63dcf10
23 changed files with 589 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
gulliver/system/class.g.php
View File

@@ -6219,4 +6219,17 @@ class G
}, $string);
return $string;
}
/**
* This function is used to create a legal SQL string that you can use in an SQL statement.
* The given string is encoded to an escaped SQL string, taking into account the current
* character set of the connection.
* @param string $string
* @return string
*/
public static function realEscapeString(string $string): string
{
$resource = Propel::getConnection('workflow')->getResource();
return mysqli_real_escape_string($resource, $string);
}
}

27
tests/unit/gulliver/system/gTest.php
View File

@@ -2,8 +2,8 @@
namespace Tests\unit\gulliver\system;
use Faker\Factory;
use G;
use MonologProvider;
use Tests\TestCase;
/**
@@ -11,6 +11,16 @@ use Tests\TestCase;
*/
class gTest extends TestCase
{
/**
* Set up method.
*/
public function setUp()
{
parent::setUp();
$this->faker = Factory::create();
}
/**
* It tests that the new words added to the array are present
*
@@ -373,4 +383,17 @@ class gTest extends TestCase
G::logTriggerExecution($data, '', '', 100);
$this->assertFalse($_SESSION['_DATA_TRIGGER_']['_TRI_LOG_']);
}
}
/**
* This test the realEscapeString method.
* @test
* @covers G::realEscapeString()
*/
public function it_should_test_realEscapeString_method()
{
$string = $this->faker->word;
$result = G::realEscapeString($string);
$this->assertNotEmpty($result);
}
}

3
tests/unit/workflow/engine/classes/CasesTest.php
View File

@@ -3,6 +3,7 @@
namespace Tests\unit\workflow\engine\classes;
use Cases;
use Exception;
use ProcessMaker\Model\Application;
use ProcessMaker\Model\Delegation;
use ProcessMaker\Model\Process;
@@ -244,7 +245,7 @@ class CasesTest extends TestCase
public function it_should_test_get_next_step_method_step_exception()
{
$cases = new Cases();
$this->expectExceptionMessage("The Application row '' doesn't exist!");
$this->expectException(Exception::class);
$res = $cases->getNextStep();
}

2
tests/unit/workflow/engine/classes/WsBaseTest.php
View File

@@ -1120,6 +1120,6 @@ class WsBaseTest extends TestCase
$ws = new WsBase();
$response = (object) $ws->cancelCase($fakeApp, $delegation->DEL_INDEX, $delegation->USR_UID);
$this->assertEquals($response->status_code, 100);
$this->assertEquals($response->message, "The Application row '$fakeApp' doesn't exist!");
$this->assertContains($fakeApp, $response->message);
}
}

64
tests/unit/workflow/engine/classes/model/ListCanceledTest.php Normal file
View File

@@ -0,0 +1,64 @@
<?php
namespace Tests\unit\workflow\engine\classes\model;
use Criteria;
use Faker\Factory;
use ListCanceled;
use ProcessMaker\Model\Delegation;
use Tests\TestCase;
class ListCanceledTest extends TestCase
{
private $listCanceled;
/**
* Set up method.
*/
public function setUp()
{
parent::setUp();
$this->faker = Factory::create();
$this->listCanceled = new ListCanceled();
}
/**
* Tear down method,
*/
public function tearDown()
{
parent::tearDown();
}
/**
* @test
* @covers ListCanceled::loadFilters()
*/
public function it_should_test_loadFilters_method()
{
$delegation = factory(Delegation::class)->create([
'DEL_THREAD_STATUS' => 'CLOSED',
]);
$criteria = new Criteria('workflow');
$filters = [
'filter' => '',
'search' => $delegation->application->APP_UID,
'process' => $delegation->process->PRO_UID,
'category' => $delegation->process->PRO_CATEGORY,
'dateFrom' => '',
'dateTo' => ''
];
$this->listCanceled->loadFilters($criteria, $filters);
$joinsMC = $criteria->getJoinsMC();
$this->assertNotEmpty($joinsMC);
$this->assertObjectHasAttribute('conditions', $joinsMC[0]);
$expected = [
'PROCESS.PRO_CATEGORY',
"'{$filters['category']}'"
];
$this->assertContains($expected, $joinsMC[0]->conditions);
}
}

67
tests/unit/workflow/engine/classes/model/ListCompletedTest.php Normal file
View File

@@ -0,0 +1,67 @@
<?php
namespace Tests\unit\workflow\engine\classes\model;
use Criteria;
use Faker\Factory;
use ListCompleted;
use ProcessMaker\Model\Delegation;
use Tests\TestCase;
class ListCompletedTest extends TestCase
{
private $listCompleted;
/**
* Set up method.
*/
public function setUp()
{
parent::setUp();
$this->faker = Factory::create();
$this->listCompleted = new ListCompleted();
}
/**
* Tear down method,
*/
public function tearDown()
{
parent::tearDown();
}
/**
* @test
* @covers ListCompleted::loadFilters()
*/
public function it_should_test_loadFilters_method()
{
$delegation = factory(Delegation::class)->create([
'DEL_THREAD_STATUS' => 'CLOSED',
]);
$criteria = new Criteria('workflow');
//the ListCompleted contains fields that were removed (DEL_DELEGATE_DATE,DEL_INIT_DATE) but are still used,
//these places are not reachable in code coverage.
$filters = [
'filter' => '', //read,unread
'search' => $delegation->application->APP_UID,
'process' => $delegation->process->PRO_UID,
'category' => $delegation->process->PRO_CATEGORY,
'dateFrom' => '',
'dateTo' => ''
];
$this->listCompleted->loadFilters($criteria, $filters);
$joinsMC = $criteria->getJoinsMC();
$this->assertNotEmpty($joinsMC);
$this->assertObjectHasAttribute('conditions', $joinsMC[0]);
$expected = [
'PROCESS.PRO_CATEGORY',
"'{$filters['category']}'"
];
$this->assertContains($expected, $joinsMC[0]->conditions);
}
}

71
tests/unit/workflow/engine/classes/model/ListInboxTest.php Normal file
View File

@@ -0,0 +1,71 @@
<?php
namespace Tests\unit\workflow\engine\classes\model;
use Criteria;
use Faker\Factory;
use ListInbox;
use ProcessMaker\Model\Delegation;
use Tests\TestCase;
class ListInboxTest extends TestCase
{
private $listInbox;
/**
* Set up method.
*/
public function setUp()
{
parent::setUp();
$this->faker = Factory::create();
$this->listInbox = new ListInbox();
}
/**
* Tear down method,
*/
public function tearDown()
{
parent::tearDown();
}
/**
* @test
* @covers ListInbox::loadFilters()
*/
public function it_should_test_loadFilters_method()
{
$delegation = factory(Delegation::class)->create([
'DEL_THREAD_STATUS' => 'CLOSED',
]);
$criteria = new Criteria('workflow');
$filters = [
'action' => 'draft', //draft,to_revise,to_reassign
'usr_uid' => $delegation->user->USR_UID,
'filter' => '',
'search' => $delegation->application->APP_UID,
'caseLink' => $delegation->application->APP_UID,
'process' => $delegation->process->PRO_UID,
'category' => $delegation->process->PRO_CATEGORY,
'dateFrom' => '',
'dateTo' => '',
'filterStatus' => 'ON_TIME', //ON_TIME,AT_RISK,OVERDUE
'newestthan' => $delegation->DEL_DELEGATE_DATE->format('Y-m-d H:i:s'),
'oldestthan' => $delegation->DEL_DELEGATE_DATE->format('Y-m-d H:i:s'),
'appUidCheck' => $delegation->application->APP_UID
];
$this->listInbox->loadFilters($criteria, $filters);
$joinsMC = $criteria->getJoinsMC();
$this->assertNotEmpty($joinsMC);
$this->assertObjectHasAttribute('conditions', $joinsMC[0]);
$expected = [
'PROCESS.PRO_CATEGORY',
"'{$filters['category']}'"
];
$this->assertContains($expected, $joinsMC[0]->conditions);
}
}

64
tests/unit/workflow/engine/classes/model/ListMyInboxTest.php Normal file
View File

@@ -0,0 +1,64 @@
<?php
namespace Tests\unit\workflow\engine\classes\model;
use Criteria;
use Faker\Factory;
use ListMyInbox;
use ProcessMaker\Model\Delegation;
use Tests\TestCase;
class ListMyInboxTest extends TestCase
{
private $listMyInbox;
/**
* Set up method.
*/
public function setUp()
{
parent::setUp();
$this->faker = Factory::create();
$this->listMyInbox = new ListMyInbox();
}
/**
* Tear down method,
*/
public function tearDown()
{
parent::tearDown();
}
/**
* @test
* @covers ListMyInbox::loadFilters()
*/
public function it_should_test_loadFilters_method()
{
$delegation = factory(Delegation::class)->create([
'DEL_THREAD_STATUS' => 'CLOSED',
]);
$criteria = new Criteria('workflow');
$filters = [
'filter' => '',
'search' => $delegation->application->APP_UID,
'process' => $delegation->process->PRO_UID,
'category' => $delegation->process->PRO_CATEGORY,
'dateFrom' => '',
'dateTo' => ''
];
$this->listMyInbox->loadFilters($criteria, $filters);
$joinsMC = $criteria->getJoinsMC();
$this->assertNotEmpty($joinsMC);
$this->assertObjectHasAttribute('conditions', $joinsMC[0]);
$expected = [
'PROCESS.PRO_CATEGORY',
"'{$filters['category']}'"
];
$this->assertContains($expected, $joinsMC[0]->conditions);
}
}

64
tests/unit/workflow/engine/classes/model/ListParticipatedHistoryTest.php Normal file
View File

@@ -0,0 +1,64 @@
<?php
namespace Tests\unit\workflow\engine\classes\model;
use Criteria;
use Faker\Factory;
use ListParticipatedHistory;
use ProcessMaker\Model\Delegation;
use Tests\TestCase;
class ListParticipatedHistoryTest extends TestCase
{
private $listParticipatedHistory;
/**
* Set up method.
*/
public function setUp()
{
parent::setUp();
$this->faker = Factory::create();
$this->listParticipatedHistory = new ListParticipatedHistory();
}
/**
* Tear down method,
*/
public function tearDown()
{
parent::tearDown();
}
/**
* @test
* @covers ListParticipatedHistory::loadFilters()
*/
public function it_should_test_loadFilters_method()
{
$delegation = factory(Delegation::class)->create([
'DEL_THREAD_STATUS' => 'CLOSED',
]);
$criteria = new Criteria('workflow');
$filters = [
'filter' => '',
'search' => $delegation->application->APP_UID,
'process' => $delegation->process->PRO_UID,
'category' => $delegation->process->PRO_CATEGORY,
'dateFrom' => '',
'dateTo' => ''
];
$this->listParticipatedHistory->loadFilters($criteria, $filters);
$joinsMC = $criteria->getJoinsMC();
$this->assertNotEmpty($joinsMC);
$this->assertObjectHasAttribute('conditions', $joinsMC[0]);
$expected = [
'PROCESS.PRO_CATEGORY',
"'{$filters['category']}'"
];
$this->assertContains($expected, $joinsMC[0]->conditions);
}
}

68
tests/unit/workflow/engine/classes/model/ListParticipatedLastTest.php Normal file
View File

@@ -0,0 +1,68 @@
<?php
namespace Tests\unit\workflow\engine\classes\model;
use Criteria;
use Faker\Factory;
use ListParticipatedLast;
use ProcessMaker\Model\Delegation;
use Tests\TestCase;
class ListParticipatedLastTest extends TestCase
{
private $listParticipatedLast;
/**
* Set up method.
*/
public function setUp()
{
parent::setUp();
$this->faker = Factory::create();
$this->listParticipatedLast = new ListParticipatedLast();
}
/**
* Tear down method,
*/
public function tearDown()
{
parent::tearDown();
}
/**
* @test
* @covers ListParticipatedLast::loadFilters()
*/
public function it_should_test_loadFilters_method()
{
$delegation = factory(Delegation::class)->create([
'DEL_THREAD_STATUS' => 'CLOSED',
]);
$criteria = new Criteria('workflow');
$filters = [
'filter' => '',
'search' => $delegation->application->APP_UID,
'caseLink' => $delegation->application->APP_UID,
'process' => $delegation->process->PRO_UID,
'category' => $delegation->process->PRO_CATEGORY,
'dateFrom' => '',
'dateTo' => '',
'filterStatus' => 'ON_TIME', //ON_TIME,AT_RISK,OVERDUE
'newestthan' => $delegation->DEL_DELEGATE_DATE->format('Y-m-d H:i:s'),
'oldestthan' => $delegation->DEL_DELEGATE_DATE->format('Y-m-d H:i:s')
];
$this->listParticipatedLast->loadFilters($criteria, $filters);
$joinsMC = $criteria->getJoinsMC();
$this->assertNotEmpty($joinsMC);
$this->assertObjectHasAttribute('conditions', $joinsMC[0]);
$expected = [
'PROCESS.PRO_CATEGORY',
"'{$filters['category']}'"
];
$this->assertContains($expected, $joinsMC[0]->conditions);
}
}

64
tests/unit/workflow/engine/classes/model/ListPausedTest.php Normal file
View File

@@ -0,0 +1,64 @@
<?php
namespace Tests\unit\workflow\engine\classes\model;
use Criteria;
use Faker\Factory;
use ListPaused;
use ProcessMaker\Model\Delegation;
use Tests\TestCase;
class ListPausedTest extends TestCase
{
private $listPaused;
/**
* Set up method.
*/
public function setUp()
{
parent::setUp();
$this->faker = Factory::create();
$this->listPaused = new ListPaused();
}
/**
* Tear down method,
*/
public function tearDown()
{
parent::tearDown();
}
/**
* @test
* @covers ListPaused::loadFilters()
*/
public function it_should_test_loadFilters_method()
{
$delegation = factory(Delegation::class)->create([
'DEL_THREAD_STATUS' => 'CLOSED',
]);
$criteria = new Criteria('workflow');
$filters = [
'filter' => '',
'search' => $delegation->application->APP_UID,
'caseLink' => $delegation->application->APP_UID,
'process' => $delegation->process->PRO_UID,
'category' => $delegation->process->PRO_CATEGORY,
'filterStatus' => 'ON_TIME' //ON_TIME,AT_RISK,OVERDUE
];
$this->listPaused->loadFilters($criteria, $filters);
$joinsMC = $criteria->getJoinsMC();
$this->assertNotEmpty($joinsMC);
$this->assertObjectHasAttribute('conditions', $joinsMC[0]);
$expected = [
'PROCESS.PRO_CATEGORY',
"'{$filters['category']}'"
];
$this->assertContains($expected, $joinsMC[0]->conditions);
}
}

66
tests/unit/workflow/engine/classes/model/ListUnassignedTest.php Normal file
View File

@@ -0,0 +1,66 @@
<?php
namespace Tests\unit\workflow\engine\classes\model;
use Criteria;
use Faker\Factory;
use ListUnassigned;
use ProcessMaker\Model\Delegation;
use Tests\TestCase;
class ListUnassignedTest extends TestCase
{
private $listUnassigned;
/**
* Set up method.
*/
public function setUp()
{
parent::setUp();
$this->faker = Factory::create();
$this->listUnassigned = new ListUnassigned();
}
/**
* Tear down method,
*/
public function tearDown()
{
parent::tearDown();
}
/**
* @test
* @covers ListUnassigned::loadFilters()
*/
public function it_should_test_loadFilters_method()
{
$delegation = factory(Delegation::class)->create([
'DEL_THREAD_STATUS' => 'CLOSED',
]);
$criteria = new Criteria('workflow');
$filters = [
'filter' => '',
'search' => $delegation->application->APP_UID,
'caseLink' => $delegation->application->APP_UID,
'process' => $delegation->process->PRO_UID,
'category' => $delegation->process->PRO_CATEGORY,
'newestthan' => $delegation->DEL_DELEGATE_DATE->format('Y-m-d H:i:s'),
'oldestthan' => $delegation->DEL_DELEGATE_DATE->format('Y-m-d H:i:s'),
'appUidCheck' => $delegation->application->APP_UID
];
$this->listUnassigned->loadFilters($criteria, $filters);
$joinsMC = $criteria->getJoinsMC();
$this->assertNotEmpty($joinsMC);
$this->assertObjectHasAttribute('conditions', $joinsMC[0]);
$expected = [
'PROCESS.PRO_CATEGORY',
"'{$filters['category']}'"
];
$this->assertContains($expected, $joinsMC[0]->conditions);
}
}

4
tests/unit/workflow/engine/src/ProcessMaker/GmailOAuth/GmailOAuthTest.php
View File

@@ -267,13 +267,13 @@ class GmailOAuthTest extends TestCase
$result = $gmailOauth->sendTestMailWithPHPMailerOAuth();
$this->assertTrue($result instanceof PHPMailerOAuth);
$this->expectException(Exception::class);
$gmailOauth = new GmailOAuth();
$gmailOauth->setFromAccount($faker->email);
$gmailOauth->setSenderEmail("");
$gmailOauth->setSenderEmail($faker->email);
$gmailOauth->setMailTo($faker->email);
$gmailOauth->setSendTestMail(1);
$result = $gmailOauth->sendTestMailWithPHPMailerOAuth();
$this->assertTrue($result instanceof PHPMailerOAuth);
}
/**

9
tests/unit/workflow/engine/src/ProcessMaker/Model/ListUnassignedTest.php
View File

@@ -16,6 +16,15 @@ use Tests\TestCase;
*/
class ListUnassignedTest extends TestCase
{
/**
* Method set up.
*/
public function setUp()
{
parent::setUp();
$this->markTestIncomplete();
}
/**
* This checks to make sure pagination is working properly
*

2
workflow/engine/classes/Cases.php
View File

@@ -569,7 +569,7 @@ class Cases
}
}
return $fields;
} catch (exception $e) {
} catch (Exception $e) {
throw ($e);
}
}

2
workflow/engine/classes/model/ListCanceled.php
View File

@@ -254,7 +254,7 @@ class ListCanceled extends BaseListCanceled implements ListInterface
$criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
$aConditions = array();
$aConditions[] = array(ListCanceledPeer::PRO_UID, ProcessPeer::PRO_UID);
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . $category . "'");
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . G::realEscapeString($category) . "'");
$criteria->addJoinMC($aConditions, Criteria::INNER_JOIN);
}

2
workflow/engine/classes/model/ListCompleted.php
View File

@@ -233,7 +233,7 @@ class ListCompleted extends BaseListCompleted implements ListInterface
$criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
$aConditions = array();
$aConditions[] = array(ListCompletedPeer::PRO_UID, ProcessPeer::PRO_UID);
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . $category . "'");
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . G::realEscapeString($category) . "'");
$criteria->addJoinMC($aConditions, Criteria::INNER_JOIN);
}

2
workflow/engine/classes/model/ListInbox.php
View File

@@ -513,7 +513,7 @@ class ListInbox extends BaseListInbox implements ListInterface
$criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
$aConditions = array();
$aConditions[] = array(ListInboxPeer::PRO_UID, ProcessPeer::PRO_UID);
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . $category . "'");
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . G::realEscapeString($category) . "'");
$criteria->addJoinMC($aConditions, Criteria::INNER_JOIN);
}
//Those filters: $newestthan, $oldestthan is used from mobile GET /light/todo

2
workflow/engine/classes/model/ListMyInbox.php
View File

@@ -210,7 +210,7 @@ class ListMyInbox extends BaseListMyInbox implements ListInterface
$criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
$aConditions = array();
$aConditions[] = array(ListMyInboxPeer::PRO_UID, ProcessPeer::PRO_UID);
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . $category . "'");
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . G::realEscapeString($category) . "'");
$criteria->addJoinMC($aConditions, Criteria::INNER_JOIN);
}

2
workflow/engine/classes/model/ListParticipatedHistory.php
View File

@@ -165,7 +165,7 @@ class ListParticipatedHistory extends BaseListParticipatedHistory implements Lis
$criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
$aConditions = array();
$aConditions[] = array(ListParticipatedHistoryPeer::PRO_UID, ProcessPeer::PRO_UID);
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . $category . "'");
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . G::realEscapeString($category) . "'");
$criteria->addJoinMC($aConditions, Criteria::INNER_JOIN);
}

2
workflow/engine/classes/model/ListParticipatedLast.php
View File

@@ -351,7 +351,7 @@ class ListParticipatedLast extends BaseListParticipatedLast implements ListInter
$criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
$aConditions = array();
$aConditions[] = array(ListParticipatedLastPeer::PRO_UID, ProcessPeer::PRO_UID);
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'".$category."'");
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . G::realEscapeString($category) . "'");
$criteria->addJoinMC($aConditions, Criteria::INNER_JOIN);
}

2
workflow/engine/classes/model/ListPaused.php
View File

@@ -270,7 +270,7 @@ class ListPaused extends BaseListPaused implements ListInterface
$criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
$aConditions = array();
$aConditions[] = array(ListPausedPeer::PRO_UID, ProcessPeer::PRO_UID);
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . $category . "'");
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . G::realEscapeString($category) . "'");
$criteria->addJoinMC($aConditions, Criteria::INNER_JOIN);
}
}

2
workflow/engine/classes/model/ListUnassigned.php
View File

@@ -209,7 +209,7 @@ class ListUnassigned extends BaseListUnassigned implements ListInterface
$criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
$aConditions = array();
$aConditions[] = array(ListUnassignedPeer::PRO_UID, ProcessPeer::PRO_UID);
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . $category . "'");
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . G::realEscapeString($category) . "'");
$criteria->addJoinMC($aConditions, Criteria::INNER_JOIN);
}