fix: validate rex_list sort column against sortable whitelist#6580
Merged
Conversation
getSortColumn() returned the raw `sort` request parameter without checking it against the columns registered via setColumnSortable(). The value was backtick-escaped (no classical SQL injection), but an authenticated backend user could still ORDER BY any column of the query's FROM tables — including unselected sensitive columns such as rex_user.password — and enumerate column names via error messages. Restrict the accepted sort column to columns flagged REX_LIST_OPT_SORT; anything else falls back to the default. The backend UI only ever emits sort links for sortable columns, so this is BC-safe for the normal flow. GHSA-4f5f-j737-pm58 Co-authored-by: de3erve-hunter <293707138+de3erve-hunter@users.noreply.github.com>
gharlan
force-pushed
the
fix/rex-list-sort-column-whitelist
branch
from
June 29, 2026 08:36
55db18f to
2947430
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
rex_list::getSortColumn()returned the rawsortrequest parameter without checking it against the columns registered viasetColumnSortable(). The value was backtick-escaped (no classical SQL injection), but an authenticated backend user could stillORDER BYany column of the query's FROM tables — including unselected sensitive columns likerex_user.password— and enumerate column names via error messages.Now only columns flagged
REX_LIST_OPT_SORTare accepted; anything else falls back to the default. The backend UI only emits sort links for sortable columns, so this is BC-safe for the normal flow.