Merge branch '1.4' into 1.5

* 1.4: Generate changelog for v1.4.7 Generate changelog for v1.3.14 Sanitize request input before passing it to expression language evaluator Sanitize request input before passing it to expression language evaluator
Sylius · Aug 18, 2020 · 34c75d0 · 34c75d0
2 parents beab269 + 063ab22
commit 34c75d0
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 2 deletions.
diff --git a/CHANGELOG-1.3.md b/CHANGELOG-1.3.md
@@ -1,5 +1,12 @@
 ## CHANGELOG FOR `1.3.x`
 
+### v1.3.14 (2020-08-18)
+
+Security release:
+
+- [CVE-2020-15143: Remote Code Execution in ParametersParser while using request parameters inside expression language](https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv)
+- [CVE-2020-15146: Remote Code Execution in OptionsParser while using request parameters inside expression language](https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5)
+
 ### v1.3.13 (2020-01-27)
 
 Security release:

diff --git a/CHANGELOG-1.4.md b/CHANGELOG-1.4.md
@@ -1,5 +1,12 @@
 ## CHANGELOG FOR `1.4.x`
 
+### v1.4.7 (2020-08-18)
+
+Security release:
+
+- [CVE-2020-15143: Remote Code Execution in ParametersParser while using request parameters inside expression language](https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv)
+- [CVE-2020-15146: Remote Code Execution in OptionsParser while using request parameters inside expression language](https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5)
+
 ### v1.4.6 (2020-01-27)
 
 Security release:

diff --git a/src/Bundle/Controller/ParametersParser.php b/src/Bundle/Controller/ParametersParser.php
@@ -80,7 +80,7 @@ private function parseRequestValueExpression(string $expression, Request $reques
                 ));
             }
 
-            return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+            return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;
         }, $expression);
 
         return $this->expression->evaluate($expression, ['container' => $this->container]);

diff --git a/src/Bundle/Grid/Parser/OptionsParser.php b/src/Bundle/Grid/Parser/OptionsParser.php
@@ -83,7 +83,7 @@ private function parseOptionExpression(string $expression, Request $request)
         $expression = (string) preg_replace_callback('/\$(\w+)/', function (array $matches) use ($request) {
             $variable = $request->get($matches[1]);
 
-            return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+            return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;
         }, $expression);
 
         return $this->expression->evaluate($expression, ['container' => $this->container]);