Sanitize query for item read/update/delete operations in Flows

[azrikahar]

Description

Fixes #13745

Problem

Normally requests pass through sanitizeQueryMiddleware:

directus/api/src/middleware/sanitize-query.ts

Line 10 in e085228

const sanitizeQueryMiddleware: RequestHandler = (req, _res, next) => {

which with the context of the reported issue in mind, includes sanitizeFilter that subsequently uses parseFilter to parse dynamic variables such as $NOW(-24 hours):

directus/api/src/utils/sanitize-query.ts

Lines 116 to 128 in 9b6e143

	function sanitizeFilter(rawFilter: any, accountability: Accountability | null) {
	let filters: Filter | null = rawFilter;
	if (typeof rawFilter === 'string') {
	try {
	filters = parseJSON(rawFilter);
	} catch {
	logger.warn('Invalid value passed for filter query parameter.');
	}
	}
	return parseFilter(filters, accountability);
	}

However, the item read/update/delete operations doesn't go through the same middleware, thus the queries are not sanitized nor parsed. This then causes error on PostgreSQL as it'll try to use the unparsed dynamic variable directly in the query:

select "events"."id", "events"."timestamp" from "events" where "events"."timestamp" <= ? order by "events"."id" asc limit ? [ '$NOW(-24 hours)', 100 ]

SQLite doesn't really throw an error, but we can also see that it's using NaN instead so the filter is incorrect:

select `events`.`id`, `events`.`timestamp` from `events` where `events`.`timestamp` <= ? order by `events`.`id` asc limit ? [NaN, 100]

Solution

Use sanitizeQuery util function within item read/update/delete operations.

• Formed query in SQlite: select `events`.`id`, `events`.`timestamp` from `events` where `events`.`timestamp` <= ? order by `events`.`id` asc limit ? [1655102827181, 100]

• Formed query in PostgreSQL: select "events"."id", "events"."timestamp" from "events" where "events"."timestamp" <= $1 order by "events"."id" asc limit $2 [Tue Jun 14 2022 15:08:21 GMT+0800 (Singapore Standard Time), 100]

Type of Change

• Bugfix
• New Feature
• Refactor / codestyle updates
• Other, please describe:

Requirements Checklist

• New / updated tests are included
• All tests are passing locally
• Performed a self-review of the submitted code

If adding a new feature:

• Documentation was added/updated