Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115446
MIME-Version: 1.0
References: <CAFv4g+HRHrvCOTgpbVfCXj06De1kL+1+RwnGgq6tcyLNAtLfQA@mail.gmail.com>
 <CAFv4g+ErRYaGJKJRJm9qYvCMQzUgbJE_hYfhTn6CtSeZ9SKxNw@mail.gmail.com>
 <CAFv4g+FH2ntZz_fSKhoFDMmjaDVhs56oR7x4tE3F250CAZsNtg@mail.gmail.com> <CAJmy8YFT9UA8fGmfAh9vcKQA=uM8nuSnEeu4U2sdD1oxQq1YjQ@mail.gmail.com>
In-Reply-To: <CAJmy8YFT9UA8fGmfAh9vcKQA=uM8nuSnEeu4U2sdD1oxQq1YjQ@mail.gmail.com>
Date: Sat, 17 Jul 2021 02:44:58 +0100
Message-ID: <CAFv4g+Hzgsjr6W=HWaWi2C1Joxz8Jg3PGwQCL7beVZc2YpLuHA@mail.gmail.com>
To: Hans Henrik Bergan <divinity76@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000bbcf2c05c747da48"
Subject: Re: [PHP-DEV] [RFC] [VOTE] is_literal
From: craig@craigfrancis.co.uk (Craig Francis)

--000000000000bbcf2c05c747da48
Content-Type: text/plain; charset="UTF-8"

On Fri, 16 Jul 2021 at 21:24, Hans Henrik Bergan <divinity76@gmail.com>
wrote:

> short of a bug in esc_like(), i don't even see the vulnerability issue in
> that code?
>


Sorry Hans, I copied the wrong diff.

There were only 2 changes from woocommerce 5.5.0 to 5.5.1.

Like you I was wondering what that diff was doing before posting - I'm
fairly sure it's just to be consistent with the other lines (which all use
$wpdb->prepare).

The diff I should have copied is:

diff -r
woocommerce.5.5.0/packages/woocommerce-blocks/src/StoreApi/Utilities/ProductQueryFilters.php
woocommerce.5.5.1/packages/woocommerce-blocks/src/StoreApi/Utilities/ProductQueryFilters.php
86c86,92
<  $attributes_to_count     = array_map( 'wc_sanitize_taxonomy_name',
$attributes );
---
>  $attributes_to_count     = array_map(
>    function( $attribute ) {
>      $attribute = wc_sanitize_taxonomy_name( $attribute );
>      return esc_sql( $attribute );
>    },
>    $attributes
>  );

In context `$attributes_to_count` simply goes to:

$attributes_to_count_sql = 'AND term_taxonomy.taxonomy IN ("' . implode(
'","', $attributes_to_count ) . '")';

Where the the esc_sql() is basically a call to mysqli_real_escape_string(),
which explains why it needs risky quotes in/around implode.

Craig

--000000000000bbcf2c05c747da48--