wip

Author: duncanmcclean

src/Assets/Asset.php

@@ -1116,7 +1116,7 @@ public function hasDuration()
 
     public function getQueryableValue(string $field)
     {
-        if (method_exists($this, $method = Str::camel($field))) {
+        if (method_exists($this, $method = Str::camel($field)) && $this->methodIsSafeToQuery($method)) {
             return $this->{$method}();
         }
 
@@ -1129,6 +1129,17 @@ public function getQueryableValue(string $field)
         return $field->fieldtype()->toQueryableValue($value);
     }
 
+    private function methodIsSafeToQuery(string $method): bool
+    {
+        return in_array($method, [
+            'id', 'path', 'folder', 'filename', 'basename', 'extension',
+            'blueprint', 'container', 'containerId', 'containerHandle',
+            'size', 'lastModified', 'mimeType',
+            'width', 'height', 'orientation', 'ratio', 'duration',
+            'isImage', 'isVideo', 'isAudio', 'isSvg', 'isMedia', 'isPdf',
+        ]);
+    }
+
     public function getCurrentDirtyStateAttributes(): array
     {
         return array_merge([

src/Auth/User.php

@@ -365,7 +365,7 @@ protected function getComputedCallbacks()
 
     public function getQueryableValue(string $field)
     {
-        if (method_exists($this, $method = Str::camel($field))) {
+        if (method_exists($this, $method = Str::camel($field)) && $this->methodIsSafeToQuery($method)) {
             return $this->{$method}();
         }
 
@@ -377,4 +377,13 @@ public function getQueryableValue(string $field)
 
         return $field->fieldtype()->toQueryableValue($value);
     }
+
+    private function methodIsSafeToQuery(string $method): bool
+    {
+        return in_array($method, [
+            'id', 'path', 'email', 'name', 'blueprint',
+            'roles', 'groups', 'isSuper',
+            'lastLogin', 'preferredLocale',
+        ]);
+    }
 }

src/Entries/Entry.php

@@ -1098,7 +1098,7 @@ public function getQueryableValue(string $field)
             Blink::store('entry-uris')->forget($this->id());
         }
 
-        if (method_exists($this, $method = Str::camel($field))) {
+        if (method_exists($this, $method = Str::camel($field)) && $this->methodIsSafeToQuery($method)) {
             return $this->{$method}();
         }
 
@@ -1111,6 +1111,15 @@ public function getQueryableValue(string $field)
         return $field->fieldtype()->toQueryableValue($value);
     }
 
+    private function methodIsSafeToQuery(string $method): bool
+    {
+        return in_array($method, [
+            'id', 'path', 'slug', 'uri', 'status', 'published',
+            'date', 'order', 'collection', 'collectionHandle',
+            'blueprint', 'locale', 'site', 'lastModified',
+        ]);
+    }
+
     public function getSearchValue(string $field)
     {
         return method_exists($this, $field) ? $this->$field() : $this->value($field);

src/Taxonomies/LocalizedTerm.php

@@ -485,7 +485,7 @@ public function repository()
 
     public function getQueryableValue(string $field)
     {
-        if (method_exists($this, $method = Str::camel($field))) {
+        if (method_exists($this, $method = Str::camel($field)) && $this->methodIsSafeToQuery($method)) {
             return $this->{$method}();
         }
 
@@ -498,6 +498,15 @@ public function getQueryableValue(string $field)
         return $field->fieldtype()->toQueryableValue($value);
     }
 
+    private function methodIsSafeToQuery(string $method): bool
+    {
+        return in_array($method, [
+            'id', 'path', 'slug', 'title', 'uri',
+            'taxonomy', 'taxonomyHandle', 'blueprint',
+            'locale', 'site', 'lastModified', 'entriesCount',
+        ]);
+    }
+
     public function getCpSearchResultBadge()
     {
         return $this->taxonomy()->title();

tests/Data/Assets/AssetQueryBuilderTest.php

@@ -715,6 +715,17 @@ public function values_can_be_plucked()
             'f.jpg',
         ], $this->container->queryAssets()->where('extension', 'jpg')->pluck('path')->all());
     }
+
+    #[Test]
+    public function sorting_by_unsafe_method_does_not_invoke_it()
+    {
+        $count = $this->container->assets()->count();
+        $this->assertGreaterThan(0, $count);
+
+        $this->container->queryAssets()->orderBy('delete', 'asc')->get();
+
+        $this->assertCount($count, $this->container->assets());
+    }
 }
 
 class CustomScope extends Scope

tests/Data/Entries/EntryQueryBuilderTest.php

@@ -1270,6 +1270,19 @@ public function exists_returns_false_when_no_results_are_found()
     {
         $this->assertFalse(Entry::query()->exists());
     }
+
+    #[Test]
+    public function sorting_by_unsafe_method_does_not_invoke_it()
+    {
+        $this->createDummyCollectionAndEntries();
+
+        $count = Entry::all()->count();
+        $this->assertGreaterThan(0, $count);
+
+        Entry::query()->orderBy('delete', 'asc')->get();
+
+        $this->assertCount($count, Entry::all());
+    }
 }
 
 class CustomScope extends Scope

tests/Data/Taxonomies/TermQueryBuilderTest.php

@@ -775,6 +775,21 @@ public function terms_are_found_using_where_relation()
         $this->assertCount(1, $terms);
         $this->assertEquals(['c'], $terms->map->slug->all());
     }
+
+    #[Test]
+    public function sorting_by_unsafe_method_does_not_invoke_it()
+    {
+        Taxonomy::make('tags')->save();
+        Term::make('a')->taxonomy('tags')->data(['title' => 'Alpha'])->save();
+        Term::make('b')->taxonomy('tags')->data(['title' => 'Bravo'])->save();
+
+        $count = Term::all()->count();
+        $this->assertGreaterThan(0, $count);
+
+        Term::query()->orderBy('delete', 'asc')->get();
+
+        $this->assertCount($count, Term::all());
+    }
 }
 
 class CustomScope extends Scope

tests/Data/Users/UserQueryBuilderTest.php

@@ -496,6 +496,20 @@ public function users_are_found_using_scopes()
         $this->assertCount(1, User::query()->customScope(['email' => 'gandalf@precious.com'])->get());
         $this->assertCount(1, User::query()->whereCustom(['email' => 'gandalf@precious.com'])->get());
     }
+
+    #[Test]
+    public function sorting_by_unsafe_method_does_not_invoke_it()
+    {
+        User::make()->email('a@example.com')->data(['name' => 'Alpha'])->save();
+        User::make()->email('b@example.com')->data(['name' => 'Bravo'])->save();
+
+        $count = User::all()->count();
+        $this->assertGreaterThan(0, $count);
+
+        User::query()->orderBy('delete', 'asc')->get();
+
+        $this->assertCount($count, User::all());
+    }
 }
 
 class CustomScope extends Scope