[5.5] Security fixes (#33858)

* fix casing issue with guarded * block json mass assignment * formatting * add boolean * protect table names and guarded * Apply fixes from StyleCI (#33772) * dont allow mass filling with table names * Apply fixes from StyleCI (#33773) * [6.x] Verify column names are actual columns when using guarded (#33777) * verify column names are actual columns when using guarded * Apply fixes from StyleCI (#33778) * remove json check * Apply fixes from StyleCI (#33857) Co-authored-by: Taylor Otwell <[email protected]> Co-authored-by: Taylor Otwell <[email protected]>
illuminate · Aug 13, 2020 · b5eed48 · b5eed48
1 parent 97b9f72
commit b5eed48
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 2 deletions.
diff --git a/Eloquent/Concerns/GuardsAttributes.php b/Eloquent/Concerns/GuardsAttributes.php
@@ -27,6 +27,13 @@ trait GuardsAttributes
      */
     protected static $unguarded = false;
 
+    /**
+     * The actual columns that exist on the database and can be guarded.
+     *
+     * @var array
+     */
+    protected static $guardableColumns = [];
+
     /**
      * Get the fillable attributes for the model.
      *
@@ -152,6 +159,7 @@ public function isFillable($key)
         }
 
         return empty($this->getFillable()) &&
+            strpos($key, '.') === false &&
             ! Str::startsWith($key, '_');
     }
 
@@ -163,7 +171,30 @@ public function isFillable($key)
      */
     public function isGuarded($key)
     {
-        return in_array($key, $this->getGuarded()) || $this->getGuarded() == ['*'];
+        if (empty($this->getGuarded())) {
+            return false;
+        }
+
+        return $this->getGuarded() == ['*'] ||
+               ! empty(preg_grep('/^'.preg_quote($key).'$/i', $this->getGuarded())) ||
+               ! $this->isGuardableColumn($key);
+    }
+
+    /**
+     * Determine if the given column is a valid, guardable column.
+     *
+     * @param  string  $key
+     * @return bool
+     */
+    protected function isGuardableColumn($key)
+    {
+        if (! isset(static::$guardableColumns[get_class($this)])) {
+            static::$guardableColumns[get_class($this)] = $this->getConnection()
+                        ->getSchemaBuilder()
+                        ->getColumnListing($this->getTable());
+        }
+
+        return in_array($key, static::$guardableColumns[get_class($this)]);
     }
 
     /**

diff --git a/Eloquent/Model.php b/Eloquent/Model.php
@@ -272,7 +272,7 @@ public function qualifyColumn($column)
      */
     protected function removeTableFromKey($key)
     {
-        return Str::contains($key, '.') ? last(explode('.', $key)) : $key;
+        return $key;
     }
 
     /**
-Original file line number
+Diff line change
@@ Expand Up / @@ -272,7 +272,7 @@ public function qualifyColumn($column) @@
          */
         protected function removeTableFromKey($key)
         {
-            return Str::contains($key, '.') ? last(explode('.', $key)) : $key;
+            return $key;
         }
         /**
@@ Expand Down @@