[
https://issues.apache.org/jira/browse/FINERACT-2761?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Terence Monteiro resolved FINERACT-2761.
----------------------------------------
Resolution: Fixed
> Validate orderBy query parameters for Center listing
> ----------------------------------------------------
>
> Key: FINERACT-2761
> URL: https://issues.apache.org/jira/browse/FINERACT-2761
> Project: Apache Fineract
> Issue Type: Bug
> Reporter: Terence Monteiro
> Assignee: Terence Monteiro
> Priority: Major
> Fix For: 1.16.0
>
>
> {{CenterReadPlatformServiceImpl}} builds SQL for the plain and paginated
> Center listing endpoints ({{{}GET /centers{}}}) by concatenating
> caller-supplied {{{}orderBy{}}}/{{{}sortOrder{}}} values before validating
> them, rather than validating each parameter independently before use. Same
> pattern already fixed for runreports and offices.
> *Fix:*
> * Validate {{orderBy}} via allow-list check before it's appended to the
> query.
> * Restrict {{sortOrder}} to a strict {{{}ASC{}}}/{{{}DESC{}}} allow-list.
> * Applied to both the plain and paginated listing methods.
> *Testing:* Regression tests added in {{CenterIntegrationTest}} for both
> endpoints — malicious {{orderBy}} and invalid {{sortOrder}} values now expect
> {{{}400{}}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
