Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

[SNYK] Sanitized and bound queries in contactgroup file #11586

Merged

Conversation

emabassi-ext
Copy link
Contributor

@emabassi-ext emabassi-ext commented Aug 15, 2022

Description

Queries should be sanitized (if possible) and bound using PDO statement to reduce attack surface and clean legacy code

Where

www/include/configuration/configObject/contactgroup/DB-Func.php

Lines:

160

150

What

Globally:

sanitize if possible each variables inserted in a query

use PDO prepared statement and bind() method

Do not use $pearDB->escape on which is for examples useless on integers and on non closed HTML tags (svg, img, etc)

Verify that IDs are saved as integers in the database before binding them

Fixes # MON-14667

Type of change

  • Patch fixing an issue (non-breaking change)
  • New functionality (non-breaking change)
  • Breaking change (patch or feature) that might cause side effects breaking part of the Software

Target serie

  • 21.04.x
  • 21.10.x
  • 22.04.x
  • 22.10.x (master)

How this pull request can be tested ?

Access to “Configuration > Users > Contact Groups” menu
image

Checklist

Community contributors & Centreon team

  • I have followed the coding style guidelines provided by Centreon
  • I have commented my code, especially new classes, functions or any legacy code modified. (docblock)
  • I have commented my code, especially hard-to-understand areas of the PR.
  • I have rebased my development branch on the base branch (master, maintenance).

@emabassi-ext emabassi-ext self-assigned this Aug 15, 2022
@emabassi-ext emabassi-ext requested a review from a team August 15, 2022 08:00
@sonarqube-decoration
Copy link

@emabassi-ext emabassi-ext merged commit 2f9a39b into develop Aug 16, 2022
@emabassi-ext emabassi-ext deleted the MON-14667-sanitize-and-bind-contactgroup-queries branch August 16, 2022 07:49
emabassi-ext added a commit that referenced this pull request Aug 29, 2022
emabassi-ext added a commit that referenced this pull request Aug 29, 2022
emabassi-ext added a commit that referenced this pull request Aug 29, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants