Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Data stream filter parameters are not validated #717

Open
mstenta opened this issue Sep 4, 2023 · 0 comments
Open

Data stream filter parameters are not validated #717

mstenta opened this issue Sep 4, 2023 · 0 comments
Labels

Comments

@mstenta
Copy link
Member

mstenta commented Sep 4, 2023

Describe the bug

Filtering sensor data by an invalid timestamp causes an SQLSTATE[22P02]: Invalid text representation error:

Drupal\Core\Database\DatabaseExceptionWrapper: SQLSTATE[22P02]: Invalid text representation: 7 ERROR: invalid input syntax for integer: "1693778399.999" LINE 5: ...mestamp" >= '1693692000') AND ("d"."timestamp" <= '169377839... ^: SELECT "d"."timestamp" AS "timestamp", "d"."value_numerator" AS "value_numerator", "d"."value_denominator" AS "value_denominator", "dsd"."name" AS "name" FROM "data_stream_basic" "d" LEFT OUTER JOIN "data_stream_data" "dsd" ON d.id = dsd.id WHERE ("d"."id" IN (:db_condition_placeholder_0)) AND ("d"."timestamp" >= :db_condition_placeholder_1) AND ("d"."timestamp" <= :db_condition_placeholder_2) ORDER BY "d"."timestamp" DESC NULLS LAST LIMIT 100000 OFFSET 0; Array ( [:db_condition_placeholder_0] => 23 [:db_condition_placeholder_1] => 1693692000 [:db_condition_placeholder_2] => 1693778399.999 ) in Drupal\data_stream\Plugin\DataStream\DataStreamType\Basic->storageGetMultiple() (line 393 of /opt/drupal/web/profiles/farm/modules/core/data_stream/src/Plugin/DataStream/DataStreamType/Basic.php).

Expected behavior

farmOS should be checking user-provided filtering parameters to make sure they are of the correct type before passing them into the \Drupal\Core\Database\Query\Select::condition() method.

@mstenta mstenta added the bug label Sep 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

1 participant