Add warning of access checking for loadMultiple() and loadByProperties() functions.

Author: Mingsong Hu

DrupalSecurity/Sniffs/Database/SqlSniff.php

@@ -32,7 +32,9 @@ class SqlSniff implements Sniff {
   protected $targetFunctions = [
     'query' => true,
     'condition' => true,
-    'accesscheck' => true,
+    'accessCheck' => true,
+    'loadMultiple' => true,
+    'loadByProperties' => true,
   ];
 
   /**
@@ -59,7 +61,7 @@ public function register() {
    */
   public function process(File $phpcsFile, $stackPtr) {
     $tokens     = $phpcsFile->getTokens();
-    $functionLc = \strtolower($tokens[$stackPtr]['content']);
+    $functionLc = $tokens[$stackPtr]['content'];
     if (isset($this->targetFunctions[$functionLc]) === false) {
       return;
     }
@@ -95,12 +97,20 @@ public function process(File $phpcsFile, $stackPtr) {
           }
         }
         break;
-      case 'accesscheck':
+      case 'accessCheck':
         if (isset($parameters[1]) && \strtolower($parameters[1]['clean']) == 'false') {
           $warning = "Query without having access check. @see https://www.drupal.org/node/3201242";
           $phpcsFile->addWarning($warning, $stackPtr, 'Access check');
         }
         break;
+      case 'loadMultiple':
+        $warning = "loadMultiple() function detected. This function won't check access during loading. @see https://www.drupal.org/docs/drupal-apis/entity-api/working-with-the-entity-api#s-checking-if-a-user-account-has-access-to-an-entity-object";
+        $phpcsFile->addWarning($warning, $stackPtr, 'Access check');
+        break;
+      case 'loadByProperties':
+        $warning = "loadByProperties() function detected. This function won't check access during loading. @see https://www.drupal.org/docs/drupal-apis/entity-api/working-with-the-entity-api#s-checking-if-a-user-account-has-access-to-an-entity-object";
+        $phpcsFile->addWarning($warning, $stackPtr, 'Access check');
+        break;
     }
   }// end process()
 }//end class

DrupalSecurity/Test/Database/SqlSniff.php

@@ -25,6 +25,22 @@
 ->condition('type', 'article')
 ->execute();
 
+// Mutiple entities loading won't check the access. You have to check the access for those entities after loading.
+$entities = \Drupal::entityTypeManager()->getStorage($entityType)->loadMultiple();
+
+
+$properties = [
+  $entityStorage->getEntityType()->getKey('bundle') => $bundleID,
+];
+// Load entities by their property values without any access checks. @see https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21Entity%21EntityStorageBase.php/function/EntityStorageBase%3A%3AloadByProperties/10
+$entities = $entityStorage->loadByProperties($properties);
+
+// Use the access() function to check the access for each entity.
+foreach ($entities as $entity) {
+  if ($entity->access('view')) {
+  }
+}
+
 // Safe
 \Database::getConnection()->query('SELECT foo FROM {table} t WHERE t.name = :name', [':name' => $_GET['user']]);