Panache - Sort properties injected in the query should be escaped somehow

[gsmet]

Currently, they are not and we could imagine a user passing the sort property from the UI to the backend leading to a potential SQL injection.

[gsmet]

@FroMage I think this one should be taken care of sooner rather than later.

[glefloch]

@gsmet, I would to start contributing to Quarkus. Is a fix for this issue still needed ?

[FroMage]

yes, that'd be great.

[ifeelgood]

@FroMage, I saw the 'good first issue' tag and the issue looks interesting enough to be my first one in open source. Can you assign it to me?
@gsmet, as a solution I'm going to deprecate io.quarkus.panache.hibernate.common.runtime.PanacheJpaUtil#toOrderBy(Sort sort) and introduce io.quarkus.panache.hibernate.common.runtime.PanacheJpaUtil#toOrderBy(Sort sort, Dialect dialect).
Is it the right direction or should I consider other options?

[FroMage]

Yeah, that could work. But why do you need a Dialect for that?

[ifeelgood]

Yeah, that could work. But why do you need a Dialect for that?

I want to escape the column names but, unfortunately, not all databases use just double quotes for this (like MySql as an exception). And hibernate Dialect has a class that implemented the logic that I want to reuse - https://docs.jboss.org/hibernate/orm/6.2/javadocs/org/hibernate/dialect/Dialect.html#toQuotedIdentifier(java.lang.String)

[yrodiere]

Reopening: we had to revert the fix in #38527 because it caused problems with attribute paths (containing dots, see #38521).

We should try again with the same code, but maybe splitting on dots before quoting; see #38521 (comment):

Split strings passed to panache on dots before escaping individual components of the path. This will prevent the use of dots in attribute names, but I guess that's acceptable? They are probably forbidden anyway; for Java fields/methods they are for sure, but I suspect there are ways to set an attribute name to something else than the field it's extracted from.

[gsmet]

Also, maybe we should provide a way to pass a raw string that is not quoted at all so that people can work around possible issues.

[ifeelgood]

Looks like I missed all the fun due to the timezone difference. I will re-work the solution next week.