Prevent sleep()/benchmark() usage in xPDO criteria

Author: opengeek

src/xPDO/Om/xPDOQuery.php

@@ -101,6 +101,12 @@ public static function isValidClause($clause) {
         $output = preg_replace('/\\".*?\\"/', '{mask}', $output);
         $output = preg_replace("/'.*?'/", '{mask}', $output);
         $output = preg_replace('/".*?"/', '{mask}', $output);
+        if (preg_match('/sleep\s*\(\s*\d+\s*\)/i', $output) > 0) {
+            return false;
+        }
+        if (preg_match('/benchmark\s*\(\s*.+,.+\s*\)/i', $output) > 0) {
+            return false;
+        }
         return strpos($output, ';') === false && strpos(strtolower($output), 'union') === false;
     }
 

test/xPDO/Test/Om/xPDOQueryTest.php

@@ -549,13 +549,46 @@ public function testInvalidClauses($clause) {
 
         $this->assertTrue($result === null, 'xPDOQuery allowed invalid clause');
     }
+
     public function providerInvalidClauses() {
         return array(
             array("1=1;DROP TABLE `person`"),
             array("1=1 UNION SELECT * FROM `person` WHERE id = 2"),
             array("1=1 UNION SELECT * FROM `person` WHERE id = 2;"),
             array(array("1=1; DROP TABLE `person`;" => '')),
             array(array("1=1 UNION SELECT * FROM `person` WHERE id = 2" => '')),
+            array("1=sleep(1)"),
+            array(array("1=sleep(1)")),
+            array("1 = sleep ( 69 )"),
+            array("sleep ( 69 )"),
+            array("1=1"),
+            array("benchmark(999, 100+1)"),
+            array("if(now()=sysdate(),sleep (20),0)"),
+        );
+    }
+
+    /**
+     * @param $clause
+     * @dataProvider providerInvalidClause
+     */
+    public function testInvalidClauseReturnsFalse($clause) {
+        $this->assertFalse(xPDOQuery::isValidClause($clause));
+    }
+
+    public function providerInvalidClause() {
+        return array(
+            array("1=1;DROP TABLE `person`"),
+            array("1=1 UNION SELECT * FROM `person` WHERE id = 2"),
+            array("1=1 UNION SELECT * FROM `person` WHERE id = 2;"),
+            array("1=1; DROP TABLE `person`;"),
+            array("1=1 UNION SELECT * FROM `person` WHERE id = 2"),
+            array("1=sleep(1)"),
+            array("1 = sleep ( 69 )"),
+            array("sleep ( 69 )"),
+            array("1=benchmark(1000,1+1)"),
+            array("1 =benchmark( 999,100+1)"),
+            array("benchmark ( 999, 100+1 )"),
+            array("if(now()=sysdate(),sleep (20),0)"),
         );
     }
 }