You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The foreignIDFilter() method in HasManyList and ManyManyList explicitly uses parameters in its WHERE IN clause, which has been found to be relatively slow.
We should modify these clauses to not use parameters, which will be faster. We will of course still have to validate that the ID values we're filtering against are ints to be safe.
We should also double check what ManyManyThroughList is doing and apply this optimisation there if feasible/necessary.
Acceptance criteria
HasManyList, ManyManyList, and ManyManyThroughList don't use parameters in the WHERE IN clause of their unfiltered SELECT queries (unless any of the ID values isn't a int)
GuySartorelli
changed the title
Optimise filtering ID foreignIDFilter in relation lists
Optimise filtering ID: foreignIDFilter in relation lists
Aug 6, 2023
There's a short explanation on this card reiterating why there's no security concern with doing this.
a) Before querying we're always validating that all ID's are integers, so there's no scope for SQL injection
b) We've only added this to code which is called via the methods forForiegnIDFilter() which are intended only for foreign ID's, similar to the intention in #10861 which still used placeholders for non primary or foreign key fields.
c) We've provide opt-out configuration for sites that still desire placeholders
Related to #10860
The
foreignIDFilter()
method inHasManyList
andManyManyList
explicitly uses parameters in itsWHERE IN
clause, which has been found to be relatively slow.We should modify these clauses to not use parameters, which will be faster. We will of course still have to validate that the ID values we're filtering against are ints to be safe.
We should also double check what
ManyManyThroughList
is doing and apply this optimisation there if feasible/necessary.Acceptance criteria
HasManyList
,ManyManyList
, andManyManyThroughList
don't use parameters in theWHERE IN
clause of their unfiltered SELECT queries (unless any of the ID values isn't a int)PRs
The text was updated successfully, but these errors were encountered: