Skip to content

Commit 1a9882a

Browse files
committed
fix: resolve subquery bare alias escape bypass regression and restore test expectations
1 parent b11412d commit 1a9882a

2 files changed

Lines changed: 5 additions & 1 deletion

File tree

system/Database/BaseConnection.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1306,6 +1306,10 @@ public function protectIdentifiers($item, bool $prefixSingle = false, ?bool $pro
13061306
$alias = '';
13071307
}
13081308

1309+
if ($alias !== '' && strcspn($item, "()'") !== strlen($item) && $this->isIdentifierEscapeExempt($item)) {
1310+
return $item . $alias;
1311+
}
1312+
13091313
// Break the string apart if it contains periods, then insert the table prefix
13101314
// in the correct location, assuming the period doesn't indicate that we're dealing
13111315
// with an alias. While we're at it, we will escape the components

tests/system/Database/BaseConnectionTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -430,7 +430,7 @@ public static function provideProtectIdentifiers(): iterable
430430
true,
431431
true,
432432
'(SELECT SUM(payments.amount) FROM payments WHERE payments.invoice_id=4) AS amount_paid)',
433-
'(SELECT SUM(payments.test_amount) FROM payments WHERE payments.invoice_id=4) AS "amount_paid)"',
433+
'(SELECT SUM(payments.amount) FROM payments WHERE payments.invoice_id=4) AS "amount_paid)"',
434434
],
435435
'sub query with missing `)` at the end' => [
436436
false,

0 commit comments

Comments
 (0)