4

I've been looking around and haven't found any definitive heuristics to detect whether or not a code-base is affected, so I've resorted to performing a recursive file scan that matches a list of regular expressions.

This has been met with varying success, as my regex powers are limited and I am getting a boatload of false-positives.

According to the technical release notes the following patterns are invalid:

$collection->addFieldToFilter('`field`', array('eq'=>3)); 

$collection->addFieldToFilter('(field1-field2)', array('eq'=>3));

Here is what I have thus far:

~("|')[^'|^"]*(\=|\-|\<|\>|\>|\!).+("|')~
~addFieldToFilter\(("|'){\$~
~addFieldToFilter\(("|')\s+`~

How can I improve these expressions to produce fewer false-positives?

1

The (very helpful) supee-6788-toolbox performs something to this effect. It looks like the regex that they're using is:

'/addFieldToFilter\(\s*[\'"]?[\`\(]/i'

Although it does have a disclaimer that it may produce false positives as well as false negatives (overlooking some occurances).

  • That expression doesn't check for "{$variable}" conditions. Think this question should be moved to a more regex-oriented board? I'm reaching out to the the regex gods on this one. – Luke A. Leber Oct 29 '15 at 20:29
  • The check() function in the script looks to be used to inspect for variables, but it's used to scan SQL resultsets. Do you plan to use your regex's on your code and/or database? – STW Oct 29 '15 at 20:36
  • Right now I'm just scanning the code-base. We're using a large third party module and I've currently found 3 spots where the front-end is subject to a SQL error from the expressions in my question. The trouble is, for every 1 positive, I'm checking out 50 negatives. – Luke A. Leber Oct 29 '15 at 20:39
  • sounds like my experience. I've been trying to think of a clever way to eat this elephant, but in the meantime I've just been whittling away at it one nibble at a time. On the bright side Magento is (finally) issuing security patches&ndash;these holes aren't new. – STW Oct 30 '15 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.