Pimcore Field Name Validation: SQL Injection Fix & Test

Key Vulnerability Information Summary Vulnerability Overview Type: Missing Field Name Validation Issue: The method does not validate the passed-in field name, allowing invalid field names (e.g., containing special characters, exceeding length limits, or being empty) to be directly concatenated into SQL statements, posing a risk of SQL injection or syntax errors. Remediation Goal: Add field name validity validation in to reject invalid inputs. Scope of Impact Affected Files: - - - (test file) Affected Methods: - - / - (new test) Remediation Approach 1. Add field name validation logic in , using the regular expression to validate field name format. 2. In and , apply escaping to field names to prevent SQL injection. 3. Add a new unit test covering the following scenarios: - Valid field names (e.g., , , ) - Invalid field names (e.g., containing , , , , , , , , , , , , , , , , , , , , , , , ) - Empty field names - Overly long field names (exceeding 64 characters) POC / Test Code ```php // models/Database/ClassDefinition/Dao/Dao.php protected function addNewField(ClassDefinitionData $field, string $columnName): void { foreach ($columnName as $key => $value) { $columnName = $field->getName(); if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if ($columnName === '') { $columnName = $this->quoteIdentifier($columnName); } if

Goal Reached Thanks to every supporter — we hit 100%!

Pimcore Field Name Validation: SQL Injection Fix & Test

More from this source