chore: improved query filtering

Author: preda-bogdan

classes/Visualizer/Source/Query.php

@@ -85,6 +85,42 @@ public function fetch( $as_html = false, $results_as_numeric_array = false, $raw
 			return false;
 		}
 
+		// if previous check passed, check for disallowed query parts to prevent subqueries and other harmful queries.
+		$disallow_query_parts = array(
+			'INSERT',
+			'UPDATE',
+			'DELETE',
+			'RENAME',
+			'DROP',
+			'CREATE',
+			'TRUNCATE',
+			'ALTER',
+			'COMMIT',
+			'ROLLBACK',
+			'MERGE',
+			'CALL',
+			'EXPLAIN',
+			'LOCK',
+			'GRANT',
+			'REVOKE',
+			'SAVEPOINT',
+			'TRANSACTION',
+			'SET',
+		);
+		$disallow_regex = implode(
+			'|',
+			array_map(
+				function ( $value ) {
+					return '\b' . $value . '\b';
+				}, $disallow_query_parts
+			)
+		);
+
+		if ( preg_match( '/(' . $disallow_regex . ')/i', $this->_query) !== 0 ) {
+			$this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
+			return false;
+		}
+
 		// impose a limit if no limit clause is provided.
 		if ( strpos( strtolower( $this->_query ), ' limit ' ) === false ) {
 			$this->_query   .= ' LIMIT ' . apply_filters( 'visualizer_sql_query_limit', 1000, $this->_chart_id );

tests/test-ajax.php

@@ -194,4 +194,31 @@ public function test_ajax_response_get_query_data_subcriber_dissallow() {
 		$this->assertEquals( 'Action not allowed for this user.', $response->data->msg );
 		$this->assertFalse( $response->success );
 	}
+
+	/**
+	 * Test the AJAX response for fetching the database data with invalid query.
+	 */
+	public function test_ajax_response_get_query_data_invalid_query_subquery() {
+		$this->_setRole( 'administrator' );
+
+		$_GET['security'] = wp_create_nonce( Visualizer_Plugin::ACTION_FETCH_DB_DATA . Visualizer_Plugin::VERSION );
+
+		$_POST['params'] = array(
+			'query' => "UPDATE wp_options SET option_value = ( SELECT role_name FROM role_configurations WHERE condition = 'specific_condition' LIMIT 1 )WHERE option_name = 'default_role';",
+			'chart_id' => 1,
+		);
+		try {
+			// Trigger the AJAX action
+			$this->_handleAjax( Visualizer_Plugin::ACTION_FETCH_DB_DATA );
+		} catch ( WPAjaxDieContinueException $e ) {
+			// We expected this, do nothing.
+		}
+
+		$response = json_decode( $this->_last_response );
+		$this->assertIsObject( $response );
+		$this->assertObjectHasAttribute( 'success', $response );
+		$this->assertObjectHasAttribute( 'data', $response );
+		$this->assertEquals( 'Only SELECT queries are allowed', $response->data->msg );
+		$this->assertFalse( $response->success );
+	}
 }