[fix] Fix columnQuote for �security issue reported by Snyk

catfan · Oct 11, 2019 · 659864b · jfcherng · Oct 12, 2019 · catfan
1 parent b3f05ed
commit 659864b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/Medoo.php b/src/Medoo.php
@@ -500,6 +500,11 @@ protected function typeMap($value, $type)
 
 	protected function columnQuote($string)
 	{
+		if (!preg_match('/^[a-zA-Z0-9]+(\.?[a-zA-Z0-9]+)?$/i', $string))
+		{
+			throw new InvalidArgumentException("Incorrect column name \"$string\"");
+		}
+
 		if (strpos($string, '.') !== false)
 		{
 			return '"' . $this->prefix . str_replace('.', '"."', $string) . '"';