[5.x] Harden OrderBys (#14421)

Author: jasonvarga

src/Fieldtypes/Entries.php

@@ -19,6 +19,7 @@
 use Statamic\Facades\User;
 use Statamic\Http\Resources\CP\Entries\EntriesFieldtypeEntries;
 use Statamic\Http\Resources\CP\Entries\EntriesFieldtypeEntry as EntryResource;
+use Statamic\Query\OrderBy;
 use Statamic\Query\OrderedQueryBuilder;
 use Statamic\Query\Scopes\Filter;
 use Statamic\Query\Scopes\Filters\Concerns\QueriesFilters;
@@ -215,7 +216,7 @@ protected function getFirstCollectionFromRequest($request)
 
     public function getSortColumn($request)
     {
-        $column = $request->sort ?? 'title';
+        $column = OrderBy::column($request->sort, 'title');
 
         if (! $request->sort && ! $request->search && count($this->getConfiguredCollections()) < 2) {
             $column = $this->getFirstCollectionFromRequest($request)->sortField();

src/Fieldtypes/Relationship.php

@@ -8,6 +8,7 @@
 use Statamic\CP\Column;
 use Statamic\Facades\Scope;
 use Statamic\Fields\Fieldtype;
+use Statamic\Query\OrderBy;
 
 abstract class Relationship extends Fieldtype
 {
@@ -307,7 +308,7 @@ public function filterExcludedItems($items, $exclusions)
 
     public function getSortColumn($request)
     {
-        return $request->get('sort');
+        return OrderBy::column($request->get('sort'));
     }
 
     public function getSortDirection($request)

src/Fieldtypes/Terms.php

@@ -21,6 +21,7 @@
 use Statamic\Facades\User;
 use Statamic\GraphQL\Types\TermInterface;
 use Statamic\Http\Resources\CP\Taxonomies\TermsFieldtypeTerms as TermsResource;
+use Statamic\Query\OrderBy;
 use Statamic\Query\OrderedQueryBuilder;
 use Statamic\Query\Scopes\Filter;
 use Statamic\Query\Scopes\Filters\Fields\Terms as TermsFilter;
@@ -311,7 +312,7 @@ protected function getFirstTaxonomyFromRequest($request)
 
     public function getSortColumn($request)
     {
-        $column = $request->get('sort');
+        $column = OrderBy::column($request->get('sort'));
 
         if (! $column && ! $request->search) {
             $column = 'title'; // todo: get from taxonomy or config

src/Http/Controllers/API/ApiController.php

@@ -8,6 +8,7 @@
 use Statamic\Facades\Scope;
 use Statamic\Facades\Site;
 use Statamic\Http\Controllers\Controller;
+use Statamic\Query\OrderBy;
 use Statamic\Support\Arr;
 use Statamic\Support\Str;
 use Statamic\Tags\Concerns\QueriesConditions;
@@ -259,7 +260,9 @@ protected function sort($query)
                     $order = 'desc';
                 }
 
-                $query->orderBy($sort, $order);
+                if ($sort = OrderBy::column($sort)) {
+                    $query->orderBy($sort, $order);
+                }
             });
 
         return $this;

src/Http/Controllers/CP/Collections/EntriesController.php

@@ -19,6 +19,7 @@
 use Statamic\Http\Requests\FilteredRequest;
 use Statamic\Http\Resources\CP\Entries\Entries;
 use Statamic\Http\Resources\CP\Entries\Entry as EntryResource;
+use Statamic\Query\OrderBy;
 use Statamic\Query\Scopes\Filters\Concerns\QueriesFilters;
 use Statamic\Support\Arr;
 use Statamic\Support\Str;
@@ -39,7 +40,7 @@ public function index(FilteredRequest $request, $collection)
             'blueprints' => $collection->entryBlueprints()->map->handle(),
         ]);
 
-        $sortField = request('sort');
+        $sortField = OrderBy::column(request('sort'));
         $sortDirection = request('order', 'asc');
 
         if (! $sortField && ! request('search')) {

src/Http/Controllers/CP/Forms/FormSubmissionsController.php

@@ -6,6 +6,7 @@
 use Statamic\Http\Controllers\CP\CpController;
 use Statamic\Http\Requests\FilteredRequest;
 use Statamic\Http\Resources\CP\Submissions\Submissions;
+use Statamic\Query\OrderBy;
 use Statamic\Query\Scopes\Filters\Concerns\QueriesFilters;
 
 class FormSubmissionsController extends CpController
@@ -26,7 +27,7 @@ public function index(FilteredRequest $request, $form)
             'form' => $form->handle(),
         ]);
 
-        $sortField = request('sort', 'date');
+        $sortField = OrderBy::column(request('sort'), 'date');
         $sortDirection = request('order', $sortField === 'date' ? 'desc' : 'asc');
 
         if ($sortField) {

src/Http/Controllers/CP/Taxonomies/TermsController.php

@@ -14,6 +14,7 @@
 use Statamic\Http\Requests\FilteredRequest;
 use Statamic\Http\Resources\CP\Taxonomies\Term as TermResource;
 use Statamic\Http\Resources\CP\Taxonomies\Terms;
+use Statamic\Query\OrderBy;
 use Statamic\Query\Scopes\Filters\Concerns\QueriesFilters;
 use Statamic\Rules\Slug;
 use Statamic\Rules\UniqueTermValue;
@@ -34,7 +35,7 @@ public function index(FilteredRequest $request, $taxonomy)
             'blueprints' => $taxonomy->termBlueprints()->map->handle(),
         ]);
 
-        $sortField = request('sort');
+        $sortField = OrderBy::column(request('sort'));
         $sortDirection = request('order', 'asc');
 
         if (! $sortField && ! request('search')) {

src/Http/Controllers/CP/Users/UsersController.php

@@ -16,6 +16,7 @@
 use Statamic\Http\Requests\FilteredRequest;
 use Statamic\Http\Resources\CP\Users\Users;
 use Statamic\Notifications\ActivateAccount;
+use Statamic\Query\OrderBy;
 use Statamic\Query\Scopes\Filters\Concerns\QueriesFilters;
 use Statamic\Rules\UniqueUserValue;
 use Statamic\Search\Result;
@@ -71,7 +72,7 @@ protected function json($request)
             'blueprints' => ['user'],
         ]);
 
-        $sortField = request('sort');
+        $sortField = OrderBy::column(request('sort'));
         $sortDirection = request('order', 'asc');
 
         if (! $sortField && ! request('search')) {

src/Query/OrderBy.php

@@ -22,6 +22,15 @@ public function __construct(string $sort, string $direction)
         $this->direction = $direction;
     }
 
+    public static function column(?string $value, ?string $default = null): ?string
+    {
+        if ($value && preg_match('/^[\w]+((\->|[.])[\w]+)*$/', $value)) {
+            return $value;
+        }
+
+        return $default;
+    }
+
     /**
      * Instantiate order by object.
      *

src/Tags/Concerns/QueriesOrderBys.php

@@ -32,7 +32,7 @@ protected function parseOrderBys()
 
         return collect(explode('|', $piped ?? ''))->filter()->map(function ($orderBy) {
             return OrderBy::parse($orderBy);
-        });
+        })->filter(fn ($orderBy) => OrderBy::column($orderBy->sort));
     }
 
     protected function preParsedOrderBys()