From 00fc5bf0e83ea26e23b252f2af58147914d658b0 Mon Sep 17 00:00:00 2001
From: Richard Lawley <richard@richardlawley.com>
Date: Tue, 14 Nov 2017 15:15:12 +0000
Subject: [PATCH] API: Validate columns parameter against fields in table
 (#7717)

* Validate columns parameter against fields in table

* Removed unused return var

* Replace schema check from DB with yaml

* Style fixes
---
 html/includes/api_functions.inc.php | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/html/includes/api_functions.inc.php b/html/includes/api_functions.inc.php
index 277040e4b7..8e03d26edd 100644
--- a/html/includes/api_functions.inc.php
+++ b/html/includes/api_functions.inc.php
@@ -818,6 +818,7 @@ function get_port_graphs()
     } else {
         $columns = 'ifName';
     }
+    validate_column_list($columns, 'ports');
 
     // use hostname as device_id if it's all digits
     $device_id   = ctype_digit($hostname) ? $hostname : getidbyname($hostname);
@@ -890,6 +891,7 @@ function get_all_ports()
     } else {
         $columns = 'ifName';
     }
+    validate_column_list($columns, 'ports');
     $ports = dbFetchRows("SELECT $columns FROM `ports` WHERE `deleted` = 0");
 
     $output = array(
@@ -1693,3 +1695,25 @@ function list_logs()
     $app->response->headers->set('Content-Type', 'application/json');
     echo _json_encode($output);
 }
+
+function validate_column_list($columns, $tableName)
+{
+    global $config;
+
+    $column_names = explode(',', $columns);
+    $db_schema = Symfony\Component\Yaml\Yaml::parse(file_get_contents($config['install_dir'] . '/misc/db_schema.yaml'));
+    $valid_columns = array_column($db_schema[$tableName]['Columns'], 'Field');
+    $invalid_columns = array_diff(array_map('trim', $column_names), $valid_columns);
+
+    if (count($invalid_columns) > 0) {
+        $output = array(
+            'status'  => 'error',
+            'message' => 'Invalid columns: ' . join(',', $invalid_columns),
+        );
+        $app = \Slim\Slim::getInstance();
+        $app->response->setStatus(400);     // Bad request
+        $app->response->headers->set('Content-Type', 'application/json');
+        echo _json_encode($output);
+        $app->stop();
+    }
+}