From 6eaa3d4123c69ca12791286c45d6aa734f71c900 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Wed, 5 Jun 2024 14:19:54 +0100
Subject: [PATCH] Bug 37018: Add validation method to
 Koha::REST::Plugin::Query.pm

---
 Koha/REST/Plugin/Query.pm | 65 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/Koha/REST/Plugin/Query.pm b/Koha/REST/Plugin/Query.pm
index 53decc94bcf..39fbe62b4a9 100644
--- a/Koha/REST/Plugin/Query.pm
+++ b/Koha/REST/Plugin/Query.pm
@@ -187,6 +187,21 @@ Generates the DBIC join attribute based on extended_attributes query entries, an
         }
     );
 
+=head3 dbic_validate_operators
+
+    $attributes = $c->dbic_validate_operators({ filtered_params => $filtered_params });
+
+Validate operators in the passed query.
+
+=cut
+
+    $app->helper(
+        'dbic_validate_operators' => sub {
+            my ( $c, $args ) = @_;
+            _validate_query($args->{filtered_params});
+        }
+    );
+
 =head3 _build_query_params_from_api
 
     my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
@@ -641,4 +656,54 @@ sub _rewrite_related_metadata_query {
     return $extended_attributes_entries;
 }
 
+=head3 _validate_operator
+
+=cut
+
+sub _validate_operator {
+    my ($operator) = @_;
+    my %allowed_operators = map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
+    die "Invalid operator: $operator" unless exists $allowed_operators{$operator};
+    return;
+}
+
+=head3 _validate_query
+
+=cut
+
+sub _validate_query {
+    my ($query) = @_;
+
+    if ( ref $query eq 'HASH' ) {
+        for my $field ( keys %$query ) {
+            my $value = $query->{$field};
+
+            if ( ref $value eq 'HASH' ) {
+
+                # Hash reference with operators
+                for my $operator ( keys %$value ) {
+                    _validate_operator($operator);
+                }
+            } elsif ( ref $value eq 'ARRAY' ) {
+
+                # Array reference with operator as the first element
+                _validate_query($value);
+            } else {
+
+                # Simple key-value pairs (no operator to validate)
+            }
+        }
+    } elsif ( ref $query eq 'ARRAY' ) {
+
+        # Top-level OR combination or nested AND combination
+        for my $element (@$query) {
+            if ( ref $element eq 'ARRAY' && $element->[0] eq '-and' ) {
+                _validate_query( $element->[1] );
+            } else {
+                _validate_query($element);
+            }
+        }
+    }
+}
+
 1;
-- 
2.45.1