[SNYK] Sanitize and bind service arguments xml queries

[emabassi-ext]

Description

Queries should be sanitized (if possible) and bound using PDO statement to reduce attack surface and clean legacy code

Where

www/include/configuration/configObject/service/xml/argumentsXml.php

Lines:

+157

+139

What

Globally:

sanitize if possible each variables inserted in a query

use PDO prepared statement and bind() method

Do not use $pearDB->escape on which is for examples useless on integers and on non closed HTML tags (svg, img, etc)

Verify that IDs are saved as integers in the database before binding them

Fixes # MON-14669

Type of change

• Patch fixing an issue (non-breaking change)
• New functionality (non-breaking change)
• Breaking change (patch or feature) that might cause side effects breaking part of the Software

Target serie

• 21.04.x
• 21.10.x
• 22.04.x
• 22.10.x (master)

How this pull request can be tested ?

Access to “Configuration > Services > Services by host” menu

Create a service from template Ping-LAN and fill arguments :

count: 3

warning: 200,20%

critical: 400,50%

Save the form

Edit the service

Checklist

Check argument values are filled

Community contributors & Centreon team

• I have followed the coding style guidelines provided by Centreon
• I have commented my code, especially new classes, functions or any legacy code modified. (docblock)
• I have commented my code, especially hard-to-understand areas of the PR.
• I have rebased my development branch on the base branch (master, maintenance).

[sonarqube-decoration]

SonarQube Quality Gate

0 Bugs
0 Vulnerabilities
0 Security Hotspots
6 Code Smells

No Coverage information
0.0% Duplication