From 70146230109e9d02b5bb37a0d27e684f06fbefbc Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Fri, 7 Mar 2025 01:25:05 +0200 Subject: [PATCH 1/2] Enhance SQL injection protection in regex patterns Updated regular expressions to strengthen protection against sleep and benchmark injection attacks. This change improves the security of queries by handling potential edge cases more effectively. --- includes/core/class-member-directory.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/includes/core/class-member-directory.php b/includes/core/class-member-directory.php index 46cbf63a..198ae7dc 100644 --- a/includes/core/class-member-directory.php +++ b/includes/core/class-member-directory.php @@ -1710,7 +1710,8 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) { $regexp_map = array( '/select(.*?)from/im', '/select(.*?)sleep/im', - "/sleep\(\d+\)/im", // avoid any sleep injections + "/sleep\(\s*[\"'`]?\s*\d+\s*[\"'`]?\s*\)/im", // avoid any sleep injections + "/benchmark\(\s*[\"'`]?\s*\d+\s*[\"'`]?\s*,.*\)/im", // avoid any benchmark injections '/select(.*?)database/im', '/select(.*?)where/im', '/update(.*?)set/im', From 51dc3b5747501d8123132d08862a60d08c340ab3 Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Fri, 7 Mar 2025 10:51:48 +0200 Subject: [PATCH 2/2] Refine regex patterns to improve injection protection. Simplified the regex patterns for detecting and preventing `sleep` and `benchmark` injections. This improves the accuracy and maintainability of the security checks in the member directory code. --- includes/core/class-member-directory.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/includes/core/class-member-directory.php b/includes/core/class-member-directory.php index 198ae7dc..0135a85f 100644 --- a/includes/core/class-member-directory.php +++ b/includes/core/class-member-directory.php @@ -1710,8 +1710,8 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) { $regexp_map = array( '/select(.*?)from/im', '/select(.*?)sleep/im', - "/sleep\(\s*[\"'`]?\s*\d+\s*[\"'`]?\s*\)/im", // avoid any sleep injections - "/benchmark\(\s*[\"'`]?\s*\d+\s*[\"'`]?\s*,.*\)/im", // avoid any benchmark injections + "/sleep\([^)]+\)/im", // avoid any sleep injections + "/benchmark\([^)]+\)/im", // avoid any benchmark injections '/select(.*?)database/im', '/select(.*?)where/im', '/update(.*?)set/im',