fix(model): block SQL injection in legacy finders via adapter-side value validation

[bpamiri]

Summary

Closes #2417. PR #2416 closed the SQL injection vector in the chainable QueryBuilder by validating typed values before they reach $quoteValue. The same root-cause pattern still existed in the legacy ORM paths that pre-date the chainable builder:

• findByKey / updateByKey / deleteByKey via $keyWhereString (sql.cfc:1325)
• findByX / findOneByX / findAllByX via dynamic finders (onmissingmethod.cfc:165)
• $buildWhereClausePart used by validatesUniquenessOf (validations.cfc:774)

All three reach Base.$quoteValue (databaseAdapters/Base.cfc:476) with user-supplied values bound to integer/float/boolean columns. The adapter returns them unquoted (a known contract for the downstream RESQLWhere regex that re-extracts bare numerics into cfqueryparam). The post-hoc regex parameterizes what it sees, but doesn't strip injected OR / UNION / comment structure — so /users/1%20OR%201%3D1 produced WHERE id=1 OR 1=1, a tautology returning the first row.

Severity: HIGH (framework-level, affects every downstream Wheels app following the canonical CRUD pattern documented in our guides).

What changed

Push the validation into Base.$quoteValue itself (approach B from #2417 — the maintainer's recommended shape). One fix point, defense for any future caller.

• vendor/wheels/databaseAdapters/Base.cfc: new $validateValueShape(str, type) runs before the adapter passes integer/float/boolean values through unquoted. Same regex/allowlist as fix(model): block SQL injection in chainable QueryBuilder via value-shape validation #2416 — ^-?[0-9]+$ for integer, ^-?[0-9]+(\.[0-9]+)?$ for float, 0,1,true,false,yes,no for boolean. Mismatches throw Wheels.InvalidValue. String columns are untouched — the adapter still wraps and escapes them.
• vendor/wheels/tests/specs/security/LegacyFinderInjectionSpec.cfc: 16 regression tests covering tautology, UNION SELECT, comment-truncation, and stacked-statement payloads against findByKey / updateByKey / deleteByKey / findAllByX / findOneByX on integer + float columns, plus accept-cases for legitimate integer (positive, negative, integer-shaped string), float, and string values.

Why adapter-side rather than caller-side

The issue flagged the audit risk for internal callers. Verified each:

Internal caller	Trust	Effect of adapter validation
read.cfc:170 (pagination)	DB-round-tripped PK values	Always valid integers — no false positives
validations.cfc:774 ($buildWhereClausePart)	Model property values	Non-numeric on integer column was already a DB error today; now a clearer Wheels.InvalidValue at the framework boundary
Base.cfc:66 (parameterize=false)	Query plan params	Malformed numerics were already broken; same — earlier failure with explicit error

No regressions in the suite (see Test plan).

Test plan

• Local Lucee 7 + SQLite via tools/test-local.sh (with port-collision workaround for the user's daily-driver server): 3413 passed, 0 failed, 0 errored — the 9 non-passes are all in browser fixture-server specs unrelated to $quoteValue.
• Docker Lucee 6 + SQLite, security suite: 173 passed, 0 failed, 0 errored — including 16/16 on the new LegacyFinderInjectionSpec.
• Docker Adobe 2025 + SQLite, model suite: 804 passed, 0 failed, 0 errored (11 explicit skips for non-MySQL-only useIndex tests).
• Docker Adobe 2025 + SQLite, security suite (with the pre-existing Adobe-incompatible McpCommandInjectionSpec temporarily set aside): 148 passed, 0 failed, 0 errored — including 16/16 on the new spec.
• CI: full test matrix on pr.yml (Lucee 5/6/7 + Adobe 2018/2021/2023/2025 + boxlang × SQLite/MySQL/Postgres/SQL Server)

Side finding (separate fix, spawned)

vendor/wheels/tests/specs/security/McpCommandInjectionSpec.cfc calls mid(s, 7) on lines 105, 117, 133, 150 — Lucee accepts the 2-arg form, Adobe CF requires 3. Pre-existing since PR #2083 (commit db722c713); crashes the Adobe 2025 security suite at compile time. Spawned as a separate fix(test) task — out of scope for this PR.

Cross-references

• Related fix on develop: #2416 — chainable QueryBuilder fix
• Tracking issue: #2417

🤖 Generated with Claude Code