Changeset 41470

Timestamp:

09/19/2017 02:47:46 PM (9 years ago)

Author:

aaroncampbell

Message:

Database: Hardening for wpdb::prepare()

Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Location:

trunk

Files:

• src/wp-includes/wp-db.php (modified) (1 diff)
• tests/phpunit/tests/db.php (modified) (1 diff)

trunk/src/wp-includes/wp-db.php

@@ -1237 +1237 @@
                 $args = func_get_args();
                 array_shift( $args );
+
                 // If args were passed as an array (as in vsprintf), move them up
-                if ( isset( $args[0] ) && is_array($args[0]) )
+                if ( is_array( $args[0] ) && count( $args ) == 1 ) {
                         $args = $args[0];
+                }
+
+                foreach ( $args as $arg ) {
+                        if ( ! is_scalar( $arg ) ) {
+                                _doing_it_wrong( 'wpdb::prepare', sprintf( __( 'Unsupported value type (%s).' ), gettype( $arg ) ), '4.8.2' );
+                        }
+                }
+
                 $query = str_replace( "'%s'", '%s', $query ); // in case someone mistakenly already singlequoted it
                 $query = str_replace( '"%s"', '%s', $query ); // doublequote unquoting

trunk/tests/phpunit/tests/db.php

@@ -355 +355 @@
         }
 
+        function test_prepare_sprintf() {
+                global $wpdb;
+
+                $prepared = $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", 1, "admin" );
+                $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = 'admin'", $prepared );
+        }
+
+        /**
+         * @expectedIncorrectUsage wpdb::prepare
+         */
+        function test_prepare_sprintf_invalid_args() {
+                global $wpdb;
+
+                $prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", 1, array( "admin" ) );
+                $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = ''", $prepared );
+
+                $prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1 ), "admin" );
+                $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 0 AND user_login = 'admin'", $prepared );
+        }
+
+        function test_prepare_vsprintf() {
+                global $wpdb;
+
+                $prepared = $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1, "admin" ) );
+                $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = 'admin'", $prepared );
+        }
+
+        /**
+         * @expectedIncorrectUsage wpdb::prepare
+         */
+        function test_prepare_vsprintf_invalid_args() {
+                global $wpdb;
+
+                $prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1, array( "admin" ) ) );
+                $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = ''", $prepared );
+
+                $prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( array( 1 ), "admin" ) );
+                $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 0 AND user_login = 'admin'", $prepared );
+        }
+
         function test_db_version() {
                 global $wpdb;