sylius/grid-bundle

Version	Released
`v1.16.1` patch	Jul 13, 2026
`v1.16.0` minor	Jul 10, 2026
`v1.16.0-RC.2` pre	Jul 10, 2026
`v1.16.0-RC.1` pre	Jul 09, 2026
`v1.16.0-ALPHA.3` pre	Jun 29, 2026
`v1.16.0-ALPHA.2` pre	Jun 19, 2026
`v1.16.0-ALPHA.1` pre	Jun 19, 2026
`v1.15.1` patch	Apr 16, 2026
`v1.15.0` minor	Jan 29, 2026
`v1.15.0-ALPHA.1` pre	Dec 04, 2025
`v1.14.1` patch	Oct 20, 2025
`v1.14.0` minor	Oct 08, 2025
`v1.14.0-ALPHA.2` pre	Sep 05, 2025
`v1.13.2` patch	Sep 05, 2025
`v1.14.0-ALPHA.1` pre	Mar 12, 2025
`v1.13.1` patch	Nov 29, 2024
`v1.13.0` minor	Oct 08, 2024
`v1.12.2` patch	Oct 08, 2024
`v1.13.0-BETA.1` pre	Oct 01, 2024
`v1.13.0-ALPHA.3` pre	Sep 24, 2024
`v1.13.0-ALPHA.2` pre	Sep 05, 2024
`v1.13.0-ALPHA.1` pre	Jan 30, 2024
`v1.12.1` patch	Jan 05, 2024
`v1.12.0` minor	Oct 31, 2022
`v1.12.0-BETA.1` pre	Oct 19, 2022
`v1.12.0-ALPHA.1` pre	May 16, 2022
`v1.11.0` minor	Apr 27, 2022
`v1.11.0-RC.3` pre	Mar 15, 2022
`v1.10.2` patch	Mar 15, 2022
`v1.11.0-RC.2` pre	Mar 14, 2022
`v1.10.1` patch	Mar 14, 2022
`v1.11.0-RC.1` pre	Mar 08, 2022
`v1.11.0-BETA.1` pre	Feb 10, 2022
`v1.11.0-ALPHA.1` pre	Feb 02, 2022
`v1.10.0` minor 1 CVE	Aug 18, 2021
`v1.9.0` minor 1 CVE	Mar 19, 2021
`v1.8.0` minor 1 CVE	Dec 08, 2020
`v1.8.0-BETA.1` pre 1 CVE	Nov 24, 2020
`v1.7.5` patch 1 CVE	Apr 14, 2020
`v1.7.4` patch 1 CVE	Jan 02, 2020
`v1.7.3` patch 1 CVE	Oct 18, 2019
`v1.7.2` patch 1 CVE	Oct 17, 2019
`v1.7.1` patch 1 CVE	Oct 17, 2019
`v1.7.0` minor 1 CVE	Oct 17, 2019
`v1.6.3` patch 1 CVE	Oct 10, 2019
`v1.6.2` patch 1 CVE	Oct 10, 2019
`v1.6.1` patch 1 CVE	Aug 28, 2019
`v1.6.0` minor 1 CVE	Aug 28, 2019
`v1.5.1` patch 1 CVE	May 21, 2019
`v1.4.5` patch 1 CVE	May 21, 2019

v1.16.1 patch

Jul 13, 2026

v1.16.0 minor

Jul 10, 2026

v1.16.0-RC.2 pre

Jul 10, 2026

v1.16.0-RC.1 pre

Jul 09, 2026

v1.16.0-ALPHA.3 pre

Jun 29, 2026

v1.16.0-ALPHA.2 pre

Jun 19, 2026

v1.16.0-ALPHA.1 pre

Jun 19, 2026

v1.15.1 patch

Apr 16, 2026

v1.15.0 minor

Jan 29, 2026

v1.15.0-ALPHA.1 pre

Dec 04, 2025

v1.14.1 patch

Oct 20, 2025

v1.14.0 minor

Oct 08, 2025

v1.14.0-ALPHA.2 pre

Sep 05, 2025

v1.13.2 patch

Sep 05, 2025

v1.14.0-ALPHA.1 pre

Mar 12, 2025

v1.13.1 patch

Nov 29, 2024

v1.13.0 minor

Oct 08, 2024

v1.12.2 patch

Oct 08, 2024

v1.13.0-BETA.1 pre

Oct 01, 2024

v1.13.0-ALPHA.3 pre

Sep 24, 2024

v1.13.0-ALPHA.2 pre

Sep 05, 2024

v1.13.0-ALPHA.1 pre

Jan 30, 2024

v1.12.1 patch

Jan 05, 2024

v1.12.0 minor

Oct 31, 2022

v1.12.0-BETA.1 pre

Oct 19, 2022

v1.12.0-ALPHA.1 pre

May 16, 2022

v1.11.0 minor

Apr 27, 2022

v1.11.0-RC.3 pre

Mar 15, 2022

v1.10.2 patch

Mar 15, 2022

v1.11.0-RC.2 pre

Mar 14, 2022

v1.10.1 patch

Mar 14, 2022

v1.11.0-RC.1 pre

Mar 08, 2022

v1.11.0-BETA.1 pre

Feb 10, 2022

v1.11.0-ALPHA.1 pre

Feb 02, 2022

v1.10.0 minor

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 18, 2021

v1.9.0 minor

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 19, 2021

v1.8.0 minor

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Dec 08, 2020

v1.8.0-BETA.1 pre

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Nov 24, 2020

v1.7.5 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Apr 14, 2020

v1.7.4 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 02, 2020

v1.7.3 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 18, 2019

v1.7.2 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 17, 2019

v1.7.1 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 17, 2019

v1.7.0 minor

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 17, 2019

v1.6.3 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 10, 2019

v1.6.2 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 10, 2019

v1.6.1 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 28, 2019

v1.6.0 minor

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 28, 2019

v1.5.1 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

May 21, 2019

v1.4.5 patch

1 CVE

CVE-2022-24752 GHSA-2xmm-g482-4439 Mar 15, 2022

DQL injection through sorting parameters blocked

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

Patches

The issue is fixed in version 1.10.1 and in 1.11-rc.1

Workarounds

You have to overwrite your Sylius\Component\Grid\Sorting\Sorter.php class:

<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}

and register it in your container:

# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected versions


          1.0.0-patch1


          1.2.4-patch1


          1.4.0-patch1


          v1.0.0


          v1.0.0-alpha.1


          v1.0.0-alpha.2


          v1.0.0-beta.1


          v1.0.0-beta.2


          v1.0.0-beta.3


          v1.0.0-rc.1


          v1.0.0-rc.2


          v1.0.1

+ 96 more


            v1.0.10


            v1.0.11


            v1.0.12


            v1.0.13


            v1.0.14


            v1.0.15


            v1.0.16


            v1.0.17


            v1.0.18


            v1.0.2


            v1.0.3


            v1.0.4


            v1.0.5


            v1.0.6


            v1.0.7


            v1.0.8


            v1.0.9


            v1.1.0


            v1.1.0-RC


            v1.1.1


            v1.1.10


            v1.1.11


            v1.1.12


            v1.1.13


            v1.1.14


            v1.1.15


            v1.1.17


            v1.1.18


            v1.1.19


            v1.1.2


            v1.1.3


            v1.1.4


            v1.1.5


            v1.1.6


            v1.1.7


            v1.1.8


            v1.1.9


            v1.10.0


            v1.2.0


            v1.2.0-BETA


            v1.2.0-RC


            v1.2.1


            v1.2.10


            v1.2.11


            v1.2.12


            v1.2.13


            v1.2.14


            v1.2.15


            v1.2.16


            v1.2.17


            v1.2.18


            v1.2.2


            v1.2.3


            v1.2.4


            v1.2.5


            v1.2.6


            v1.2.7


            v1.2.8


            v1.2.9


            v1.3.0


            v1.3.0-BETA


            v1.3.1


            v1.3.10


            v1.3.11


            v1.3.12


            v1.3.13


            v1.3.2


            v1.3.3


            v1.3.4


            v1.3.5


            v1.3.6


            v1.3.7


            v1.3.8


            v1.3.9


            v1.4.0


            v1.4.0-BETA.1


            v1.4.1


            v1.4.2


            v1.4.3


            v1.4.4


            v1.4.5


            v1.5.0


            v1.5.1


            v1.6.0


            v1.6.1


            v1.6.2


            v1.6.3


            v1.7.0


            v1.7.1


            v1.7.2


            v1.7.3


            v1.7.4


            v1.7.5


            v1.8.0


            v1.8.0-BETA.1


            v1.9.0

Fixed in


          1.10.1

References

Updated Nov 08, 2023 · Source: OSV.dev

May 21, 2019

Activity

Reach

Details