🔒 (SQL injection) Fixed 2 SQL injection flaws in Filters

SearchInNamesFilter and UEFilter both contained a SQL injection flaw. It has been fixed

Author: Teddy Roncin

src/ApiPlatform/SearchInNamesFilter.php

@@ -27,9 +27,11 @@ protected function filterProperty(string $property, $value, QueryBuilder $queryB
         }
         $alias = $queryBuilder->getRootAliases()[0];
         $infoAlias = $queryNameGenerator->generateJoinAlias('info');
+        $valueParameter = $queryNameGenerator->generateParameterName('value');
         $queryBuilder
             ->innerJoin("{$alias}.infos", $infoAlias)
-            ->andWhere("({$alias}.firstName LIKE '%{$value}%' OR {$alias}.lastName LIKE '%{$value}%' OR {$infoAlias}.nickname LIKE '%{$value}%')")
+            ->andWhere("({$alias}.firstName LIKE :{$valueParameter} OR {$alias}.lastName LIKE :{$valueParameter} OR {$infoAlias}.nickname LIKE :{$valueParameter})")
+            ->setParameter($valueParameter, "%{$value}%")
         ;
     }
 }

src/ApiPlatform/UEFilter.php

@@ -27,18 +27,21 @@ protected function filterProperty(string $property, $value, QueryBuilder $queryB
             return;
         }
         $alias = $queryBuilder->getRootAliases()[0];
+        $nowParameter = $queryNameGenerator->generateParameterName('now');
         foreach ($value as $ueCode) {
             $ueAlias = $queryNameGenerator->generateJoinAlias('UE');
             $ueSubscriptionAlias = $queryNameGenerator->generateJoinAlias('UEsSubscriptions');
             $semesterAlias = $queryNameGenerator->generateJoinAlias('Semester');
+            $ueParameter = $queryNameGenerator->generateParameterName('ue');
             $queryBuilder->innerJoin("{$alias}.UEsSubscriptions", $ueSubscriptionAlias)
                 ->innerJoin("{$ueSubscriptionAlias}.UE", $ueAlias)
                 ->innerJoin("{$ueSubscriptionAlias}.semester", $semesterAlias)
-                ->andWhere("{$ueAlias}.code = '{$ueCode}'")
-                ->andWhere("{$semesterAlias}.start <= :now")
-                ->andWhere("{$semesterAlias}.end >= :now")
+                ->andWhere("{$ueAlias}.code = :{$ueParameter}")
+                ->andWhere("{$semesterAlias}.start <= :{$nowParameter}")
+                ->andWhere("{$semesterAlias}.end >= :{$nowParameter}")
+                ->setParameter($ueParameter, $ueCode)
             ;
         }
-        $queryBuilder->setParameter('now', new \DateTime());
+        $queryBuilder->setParameter($nowParameter, new \DateTime());
     }
 }