\TYPO3\CMS\Extbase\Persistence\Repository and createNamedParameter

user_1835353 0
Viewed 89

maybe this is a nonsense question ... but I got a little lost in Typo3 security

I have my own extension, with an action -> list that has a "keyword" search field in the frontend

 <f:form action = "list">
   <f:form.textfield name = "keyword" />
<f:form submit value "search">
</f:form>

In my repository, I wrote some code :

class MyRepository extends \TYPO3\CMS\Extbase\Persistence\Repository
        {
            public function findByFilters(string $keyword)
            {
                $query = $this->createQuery();
                if (isset($keyword) && strlen($keyword) > 0) {
                    $constraints[] = $query->like('nome_corso', '%' . $keyword . '%');

                }
                /* other constraints[] */

                $query->matching($query->logicalAnd($constraints));
                $result = $query->execute();
                return ($result);

            }
        }

QUESTION : Now, i've got a "wildcard" $keyword" and i want avoid sql injection.

Typo3 Manuals suggest to abandon individual database query, and adopt QueryBuilder with createNamedParameter.

https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ApiOverview/Database/QueryBuilder/Index.html#createnamedparameter

Is it really necessary to abandon the individual Query databases derived from the Repository class, and migrate to QueryBuilder, in order to avoid sql injection, or is it possible to set createNamedParameter directly in the query object derived from Repository class?

typo3
1 Answers

The described LIKE query in your Extbase repository is safe against SQL injection, since Extbase converts the query to a Doctrine query, where prepared statements with placeholders for parameters values are used. See Typo3DbQueryParser::convertQueryToDoctrineQueryBuilder() for details.

However, the query is vulnerable against SQL Wildcard attacks, which may result in Denial of Service. It is therefore always required to ensure, that parameter values in LIKE queries (both in Extbase repositories and in Doctrine DBAL queries) are protected against SQL Wildcard attacks. This has to be done manually.

TYPO3 Doctrine QueryBuilder has a helper function called escapeLikeWildcards() (see documentation) which must be used for LIKE queries in Doctrine queries. For Extbase repositories, there is no helper function available, so the functionality of escapeLikeWildcards() has to be applied manually using addcslashes($value, '_%').

So for your Extbase query constraint, the SQL Wildcard attack prevention should be as shown below:

$constraints[] = $query->like('nome_corso', '%' . addcslashes($keyword, '_%') . '%');
user_17447430
Related