[fix] Fix columnQuote for �security issue reported by Snyk

catfan · Oct 11, 2019 · 659864b · jfcherng · Oct 12, 2019 · catfan
1 parent b3f05ed
commit 659864b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/Medoo.php b/src/Medoo.php
@@ -500,6 +500,11 @@ protected function typeMap($value, $type)
 
  protected function columnQuote($string)
  {
+ if (!preg_match('/^[a-zA-Z0-9]+(\.?[a-zA-Z0-9]+)?$/i', $string))
+ {
+ throw new InvalidArgumentException("Incorrect column name \"$string\"");
+ }
+
  if (strpos($string, '.') !== false)
  {
  return '"' . $this->prefix . str_replace('.', '"."', $string) . '"';