From 2bc50123ece64293ad83e87fb6c0d441aeaecec2 Mon Sep 17 00:00:00 2001
From: Hammat Wele <hammat.wele@inlibro.com>
Date: Mon, 10 Jun 2024 12:03:13 +0000
Subject: [PATCH] Bug 37018: (follow-up) Avoid executing invalid query

---
 Koha/REST/Plugin/Objects.pm |  4 +-
 Koha/REST/Plugin/Query.pm   | 76 +++++++++++++++++++++++++++++++++++++
 t/Koha/REST/Plugin/Query.t  | 31 ++++++++++++++-
 3 files changed, 109 insertions(+), 2 deletions(-)

diff --git a/Koha/REST/Plugin/Objects.pm b/Koha/REST/Plugin/Objects.pm
index 59f6228097..4c8b445058 100644
--- a/Koha/REST/Plugin/Objects.pm
+++ b/Koha/REST/Plugin/Objects.pm
@@ -295,7 +295,9 @@ controller, and thus shouldn't be called twice in it.
                 }
             );
 
-            $c->dbic_validate_operators({ filtered_params => $filtered_params});
+            if ( $c->dbic_validate_operators( { filtered_params => $filtered_params } ) ) {
+                $filtered_params = $c->dbic_remove_invalid_operators( { filtered_params => $filtered_params } );
+            }
 
             # Generate the resultset
             my $objects_rs = $result_set->search( $filtered_params, $attributes );
diff --git a/Koha/REST/Plugin/Query.pm b/Koha/REST/Plugin/Query.pm
index a4160ac7d2..a091ad0ca1 100644
--- a/Koha/REST/Plugin/Query.pm
+++ b/Koha/REST/Plugin/Query.pm
@@ -212,6 +212,24 @@ Validate operators in the passed query.
         }
     );
 
+=head3 dbic_validate_operators
+
+    $filtered_params = $c->dbic_remove_invalid_operators({ filtered_params => $filtered_params});
+
+Remove invalid operators from query
+
+=cut
+
+$app->helper(
+    'dbic_remove_invalid_operators' => sub {
+        my ( $c, $args ) = @_;
+        my @invalid_operators = _get_invalid_operators( $args->{filtered_params} );
+        my %badoperators      = map { $_ => 1 } @invalid_operators;
+        my $filtered_params   = _remove_invalid_operators( $args->{filtered_params}, %badoperators );
+        return $filtered_params;
+    }
+);
+
 =head3 _build_query_params_from_api
 
     my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
@@ -717,4 +735,62 @@ sub _validate_query {
     }
 }
 
+my @invalid_operators;
+
+sub _get_invalid_operators {
+    my ($query) = @_;
+    if ( ref $query eq 'HASH' ) {
+
+        for my $field ( keys %$query ) {
+            my $value = $query->{$field};
+            if ( ref $value eq 'HASH' ) {
+
+                # Hash reference with operators
+                my %allowed_operators =
+                    map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
+                for my $operator ( keys %$value ) {
+                    push( @invalid_operators, $operator ) unless exists $allowed_operators{$operator};
+                }
+            } elsif ( ref $value eq 'ARRAY' ) {
+
+                # Array reference with operator as the first element
+                _get_invalid_operators($value);
+            } else {
+
+                # Simple key-value pairs (no operator to validate)
+            }
+        }
+    } elsif ( ref $query eq 'ARRAY' ) {
+
+        # Top-level OR combination or nested AND combination
+        for my $element (@$query) {
+            if ( ref $element eq 'ARRAY' && $element->[0] eq '-and' ) {
+                _get_invalid_operators( $element->[1] );
+            } else {
+                _get_invalid_operators($element);
+            }
+        }
+    }
+    return @invalid_operators;
+}
+
+sub _remove_invalid_operators {
+    my ( $q_params, %badoperators ) = @_;
+    if ( reftype($q_params) && reftype($q_params) eq 'HASH' ) {
+        my $parsed_hash;
+        foreach my $key ( keys %{$q_params} ) {
+            if ( exists( $badoperators{$key} ) ) {
+                $key = '';
+            }
+            $parsed_hash->{$key} = _remove_invalid_operators( $q_params->{$key}, %badoperators );
+        }
+        return $parsed_hash;
+    } elsif ( reftype($q_params) && reftype($q_params) eq 'ARRAY' ) {
+        my @mapped = map { _remove_invalid_operators( $_, %badoperators ) } @$q_params;
+        return \@mapped;
+    } else {
+        return $q_params;
+    }
+}
+
 1;
diff --git a/t/Koha/REST/Plugin/Query.t b/t/Koha/REST/Plugin/Query.t
index 477df53dc5..f15e82ab9e 100755
--- a/t/Koha/REST/Plugin/Query.t
+++ b/t/Koha/REST/Plugin/Query.t
@@ -216,6 +216,25 @@ get '/dbic_validate_operators' => sub {
     $c->render( json => { filtered_params => $query }, status => 200 );
 };
 
+get '/dbic_remove_invalid_operators' => sub {
+    my ( $c, $args ) = @_;
+
+    my $query = $c->req->json->{q};
+
+    $c->dbic_validate_operators({ filtered_params => $query });
+
+    $c->render( json => { filtered_params => $query }, status => 200 );
+};
+
+#get '/merge_q_params' => sub {
+  #my $c = shift;
+  #my $filtered_params = {'biblio_id' => 1};
+  #my $result_set = Koha::Biblios->new;
+  #$filtered_params = $c->merge_q_params($filtered_params, $c->req->json->{q}, $result_set);
+#
+  #$c->render( json => $filtered_params, status => 200 );
+#};
+
 get '/stash_embed' => sub {
     my $c = shift;
 
@@ -347,7 +366,7 @@ sub to_model {
 
 # The tests
 
-use Test::More tests => 9;
+use Test::More tests => 10;
 use Test::Mojo;
 
 subtest 'extract_reserved_params() tests' => sub {
@@ -683,3 +702,13 @@ subtest 'dbic_validate_operators' => sub {
     $t->get_ok( '/dbic_validate_operators' => json => { q => $q } )->status_is(400);
 
 };
+
+subtest 'dbic_remove_invalid_operators' => sub {
+    plan tests => 2;
+
+    my $t = Test::Mojo->new;
+
+    my $q = [ { "-and" => [ [ { "biblio_id" => { "like(sleep(1/100000))or" => "%a%" } } ] ] } ];
+    $t->get_ok( '/dbic_remove_invalid_operators' => json => { q => $q } )->status_is(200);
+
+};
\ No newline at end of file
-- 
2.34.1