4 ms·

What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?

reddalo 2mo ago
WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.
- mewpmewp2 2mo ago
  That could as well just be a complete new product then, right? It would definitely be a breaking change and unmigratable.
- sourcecodeplz 2mo ago
  Who is they? automaticc?
- mapmeld 2mo ago
  A few months back, Cloudflare used AI to make a Rust rewrite of WordPress, but I doubt that they would have found or corrected issues like this on the way? https://blog.cloudflare.com/emdash-wordpress/ https://blog.cloudflare.com/emdash-wordpress/
  - mkl 2mo ago
    TypeScript, not Rust.
- pluc 2mo ago
  Mullenweg will never allow WP to slip away from his control. "He wrote it" so you can't have it.
  - deleted 2mo ago
    [deleted]
- dncornholio 2mo ago
  Impossible. WordPress has had the PHP-group even considering writing new PHP features in a separate 7.4 branche and release them specifically for WP.
Yokohiii 2mo ago
To construct dynamic sql queries to have to string concatenate at least some parts, . User data should of course be passed via prepared statements.
- formerly_proven 2mo ago
  Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.
  - winstonwinston 2mo ago
    Quick search shows this in Wordpress: > WordPress database access abstraction class. class wpdb {} So this is some sort of ORM provided. $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT ); > Some of the methods in this class take an SQL statement as input. All untrusted values in an SQL statement must be escaped to prevent SQL injection attacks. Some methods will escape SQL for you; others will not. Check the documentation to be sure before you use any method in this class. For more on SQL escaping in WordPress, see the section entitled Protect Queries Against SQL Injection Attacks below. It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.
    - codedokode 2mo ago
      It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.
- codedokode 2mo ago
  One usually uses "query builder" pattern for that. Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.

reddalo 2mo ago

WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.

mewpmewp2 2mo ago
That could as well just be a complete new product then, right? It would definitely be a breaking change and unmigratable.
sourcecodeplz 2mo ago
Who is they? automaticc?
mapmeld 2mo ago
A few months back, Cloudflare used AI to make a Rust rewrite of WordPress, but I doubt that they would have found or corrected issues like this on the way? https://blog.cloudflare.com/emdash-wordpress/ https://blog.cloudflare.com/emdash-wordpress/
- mkl 2mo ago
  TypeScript, not Rust.
pluc 2mo ago
Mullenweg will never allow WP to slip away from his control. "He wrote it" so you can't have it.
- deleted 2mo ago
  [deleted]
dncornholio 2mo ago
Impossible. WordPress has had the PHP-group even considering writing new PHP features in a separate 7.4 branche and release them specifically for WP.

Yokohiii 2mo ago

To construct dynamic sql queries to have to string concatenate at least some parts, . User data should of course be passed via prepared statements.

formerly_proven 2mo ago
Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.
- winstonwinston 2mo ago
  Quick search shows this in Wordpress: > WordPress database access abstraction class. class wpdb {} So this is some sort of ORM provided. $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT ); > Some of the methods in this class take an SQL statement as input. All untrusted values in an SQL statement must be escaped to prevent SQL injection attacks. Some methods will escape SQL for you; others will not. Check the documentation to be sure before you use any method in this class. For more on SQL escaping in WordPress, see the section entitled Protect Queries Against SQL Injection Attacks below. It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.
  - codedokode 2mo ago
    It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.
codedokode 2mo ago
One usually uses "query builder" pattern for that. Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.