Escape user input in LIKE queries via escapeLikeValue()

Multiple SQL queries used `LIKE ?` with raw user-controlled input concatenated with `%` wildcards. Without escaping, `%` and `_` characters in the input were interpreted as wildcards, allowing broader matches than intended and enabling potential information disclosure via crafted search strings.

Author: BurntimeX

wcfsetup/install/files/lib/command/style/CopyStyle.class.php

@@ -145,7 +145,7 @@ private function getUniqueStyleName(Style $style): string
                     AND styleID <> ?";
         $statement = WCF::getDB()->prepare($sql);
         $statement->execute([
-            $style->styleName . '%',
+            WCF::getDB()->escapeLikeValue($style->styleName) . '%',
             $style->styleID,
         ]);
         $numbers = [];

wcfsetup/install/files/lib/data/article/ArticleAction.class.php

@@ -930,7 +930,7 @@ public function search()
                 ORDER BY    title";
         $statement = WCF::getDB()->prepare($sql, 5);
         $statement->execute([
-            '%' . $this->parameters['searchString'] . '%',
+            '%' . WCF::getDB()->escapeLikeValue($this->parameters['searchString']) . '%',
             WCF::getLanguage()->languageID,
         ]);
 

wcfsetup/install/files/lib/data/package/update/PackageUpdateAction.class.php

@@ -94,7 +94,7 @@ public function search()
 
         $conditions = new PreparedStatementConditionBuilder();
         $conditions->add("package_update.packageUpdateServerID IN (?)", [\array_keys($availableUpdateServers)]);
-        $searchString = '%' . $this->parameters['searchString'] . '%';
+        $searchString = '%' . WCF::getDB()->escapeLikeValue($this->parameters['searchString']) . '%';
         $conditions->add(
             "(package_update.package LIKE ? OR package_update.packageDescription LIKE ? OR package_update.packageName LIKE ?)",
             [$searchString, $searchString, $searchString]

wcfsetup/install/files/lib/data/page/PageAction.class.php

@@ -370,7 +370,7 @@ public function search()
                 ORDER BY    name";
         $statement = WCF::getDB()->prepare($sql, 5);
         $statement->execute([
-            '%' . $this->parameters['searchString'] . '%',
+            '%' . WCF::getDB()->escapeLikeValue($this->parameters['searchString']) . '%',
             0,
         ]);
 

wcfsetup/install/files/lib/data/search/keyword/SearchKeywordAction.class.php

@@ -53,7 +53,7 @@ public function getSearchResultList()
                 WHERE       keyword LIKE ?
                 ORDER BY    searches DESC";
         $statement = WCF::getDB()->prepare($sql, 10);
-        $statement->execute([$this->parameters['data']['searchString'] . '%']);
+        $statement->execute([WCF::getDB()->escapeLikeValue($this->parameters['data']['searchString']) . '%']);
         while ($row = $statement->fetchArray()) {
             $list[] = [
                 'label' => $row['keyword'],

wcfsetup/install/files/lib/data/tag/TagAction.class.php

@@ -129,7 +129,7 @@ public function getSearchResultList()
         $list = [];
 
         $conditionBuilder = new PreparedStatementConditionBuilder();
-        $conditionBuilder->add("name LIKE ?", [$this->parameters['data']['searchString'] . '%']);
+        $conditionBuilder->add("name LIKE ?", [WCF::getDB()->escapeLikeValue($this->parameters['data']['searchString']) . '%']);
         if (!empty($excludedSearchValues)) {
             $conditionBuilder->add("name NOT IN (?)", [$excludedSearchValues]);
         }

wcfsetup/install/files/lib/data/user/UserAction.class.php

@@ -606,7 +606,7 @@ public function getSearchResultList()
         }
 
         // find users
-        $searchString = \addcslashes($searchString, '_%');
+        $searchString = WCF::getDB()->escapeLikeValue($searchString);
         $parameters = [
             'searchString' => $searchString,
         ];

wcfsetup/install/files/lib/form/UserSearchForm.class.php

@@ -209,7 +209,7 @@ protected function search()
     protected function buildStaticConditions()
     {
         if (!empty($this->username)) {
-            $this->conditions->add("user_table.username LIKE ?", ['%' . \addcslashes($this->username, '_%') . '%']);
+            $this->conditions->add("user_table.username LIKE ?", ['%' . WCF::getDB()->escapeLikeValue($this->username) . '%']);
         }
     }
 

wcfsetup/install/files/lib/system/endpoint/controller/core/messages/GetMentionSuggestions.class.php

@@ -70,7 +70,7 @@ public function __invoke(ServerRequestInterface $request, array $variables): Res
     private function getUsers(string $query): array
     {
         $userProfileList = new UserProfileList();
-        $userProfileList->getConditionBuilder()->add("username LIKE ?", [$query . '%']);
+        $userProfileList->getConditionBuilder()->add("username LIKE ?", [WCF::getDB()->escapeLikeValue($query) . '%']);
 
         $userProfileList->sqlLimit = 10;
         $userProfileList->readObjects();

wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTextParser.class.php

@@ -290,7 +290,7 @@ protected function lookupUsernames(array $usernames)
 
         if (!empty($likeValues)) {
             for ($i = 0, $length = \count($likeValues); $i < $length; $i++) {
-                $conditions->add('username LIKE ?', [\str_replace('%', '', $likeValues[$i]) . '%']);
+                $conditions->add('username LIKE ?', [WCF::getDB()->escapeLikeValue($likeValues[$i]) . '%']);
             }
         }