farmOS icon indicating copy to clipboard operation
farmOS copied to clipboard

Data stream filter parameters are not validated

Open mstenta opened this issue 11 months ago • 0 comments

Describe the bug

Filtering sensor data by an invalid timestamp causes an SQLSTATE[22P02]: Invalid text representation error:

Drupal\Core\Database\DatabaseExceptionWrapper: SQLSTATE[22P02]: Invalid text representation: 7 ERROR: invalid input syntax for integer: "1693778399.999" LINE 5: ...mestamp" >= '1693692000') AND ("d"."timestamp" <= '169377839... ^: SELECT "d"."timestamp" AS "timestamp", "d"."value_numerator" AS "value_numerator", "d"."value_denominator" AS "value_denominator", "dsd"."name" AS "name" FROM "data_stream_basic" "d" LEFT OUTER JOIN "data_stream_data" "dsd" ON d.id = dsd.id WHERE ("d"."id" IN (:db_condition_placeholder_0)) AND ("d"."timestamp" >= :db_condition_placeholder_1) AND ("d"."timestamp" <= :db_condition_placeholder_2) ORDER BY "d"."timestamp" DESC NULLS LAST LIMIT 100000 OFFSET 0; Array ( [:db_condition_placeholder_0] => 23 [:db_condition_placeholder_1] => 1693692000 [:db_condition_placeholder_2] => 1693778399.999 ) in Drupal\data_stream\Plugin\DataStream\DataStreamType\Basic->storageGetMultiple() (line 393 of /opt/drupal/web/profiles/farm/modules/core/data_stream/src/Plugin/DataStream/DataStreamType/Basic.php).

Expected behavior

farmOS should be checking user-provided filtering parameters to make sure they are of the correct type before passing them into the \Drupal\Core\Database\Query\Select::condition() method.

mstenta avatar Sep 04 '23 18:09 mstenta