prevent one more Page.Column sql injection (#35)

Author: attente

page.go

@@ -41,6 +41,7 @@ func (s Sort) String() string {
 var _MatcherOrderBy = regexp.MustCompile(`-?([a-zA-Z0-9]+)`)
 
 func NewSort(s string) (Sort, bool) {
+	s = strings.TrimSpace(s)
 	if s == "" || !_MatcherOrderBy.MatchString(s) {
 		return Sort{}, false
 	}
@@ -81,6 +82,7 @@ func (p *Page) GetOrder(defaultSort ...string) []Sort {
 	// if page has sort, use it
 	if p != nil && len(p.Sort) != 0 {
 		for i, s := range p.Sort {
+			s.Column = strings.TrimSpace(s.Column)
 			s.Column = pgx.Identifier(strings.Split(s.Column, ".")).Sanitize()
 			p.Sort[i] = s
 		}
@@ -99,7 +101,12 @@ func (p *Page) GetOrder(defaultSort ...string) []Sort {
 	// use column
 	sort := make([]Sort, 0)
 	for _, part := range strings.Split(p.Column, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
 		if s, ok := NewSort(part); ok {
+			s.Column = pgx.Identifier(strings.Split(s.Column, ".")).Sanitize()
 			sort = append(sort, s)
 		}
 	}

page_test.go

@@ -61,3 +61,29 @@ func TestInvalidSort(t *testing.T) {
 	require.Equal(t, "SELECT * FROM t ORDER BY \"ID; DROP TABLE users;\" ASC, \"name\" DESC LIMIT 11 OFFSET 0", sql)
 	require.Empty(t, args)
 }
+
+func TestPageColumnInjection(t *testing.T) {
+	paginator := pgkit.NewPaginator[T]()
+	page := pgkit.NewPage(0, 0)
+	page.Column = "id; DROP TABLE users;--"
+
+	_, query := paginator.PrepareQuery(sq.Select("*").From("t"), page)
+
+	sql, args, err := query.ToSql()
+	require.NoError(t, err)
+	require.Equal(t, "SELECT * FROM t ORDER BY \"id; DROP TABLE users;--\" ASC LIMIT 11 OFFSET 0", sql)
+	require.Empty(t, args)
+}
+
+func TestPageColumnSpaces(t *testing.T) {
+	paginator := pgkit.NewPaginator[T]()
+	page := pgkit.NewPage(0, 0)
+	page.Column = "id, name"
+
+	_, query := paginator.PrepareQuery(sq.Select("*").From("t"), page)
+
+	sql, args, err := query.ToSql()
+	require.NoError(t, err)
+	require.Equal(t, "SELECT * FROM t ORDER BY \"id\" ASC, \"name\" ASC LIMIT 11 OFFSET 0", sql)
+	require.Empty(t, args)
+}