GeezerVison

Issue & Reproduction Steps

SQLi /api/1.0/processes/{process}/aggregation

processes.aggregation was stored with no validation and later interpolated into Process::getProcessStageCounts():

sprintf("JSON_EXTRACT(data, '$.%s')", $amountKey)

A user who can create processes could save a value that closed the string literal and injected SQL into the SELECT list. The query ran on GET /api/1.0/processes/{process}/stage-mapping. The same column is also mass-assignable on process create, update, and import.

Solution

• Bind the JSON path in getProcessStageCounts() and fall back to amount when the stored value is not a variable name.
• Validate every write through AggregationVariable (Process::rules(), saveAggregation) and the HasAggregationAttribute mutator on Process and ProcessVersion, which also covers import.
• Share the allowlist in JsonDataPath. BaseFilter now builds its JSON path through the same helper.

How to Test

• ./vendor/bin/phpunit 'tests/Feature/Api/ProcessControllerTest.php'
• ./vendor/bin/phpunit 'tests/Feature/ImportExport/Exporters/ProcessExporterTest.php'
• ./vendor/bin/phpunit 'tests/unit/ProcessMaker/FilterTest.php'
• ./vendor/bin/phpunit 'tests/unit/ProcessMaker/Support/JsonDataPathTest.php'
• ./vendor/bin/phpunit 'tests/unit/ProcessMaker/Rules/AggregationVariableTest.php'

Related Tickets & Packages

FOUR-34303

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

ci:deploy