From 3df872b9a17ddc3d9a3e25b1b4ebb5cf0f3d843f Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Thu, 8 Sep 2022 12:43:37 +0200 Subject: add a limit to the amount of operators a client can add to a search query Signed-off-by: Robin Appelman --- apps/dav/lib/Files/FileSearchBackend.php | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'apps/dav/lib/Files/FileSearchBackend.php') diff --git a/apps/dav/lib/Files/FileSearchBackend.php b/apps/dav/lib/Files/FileSearchBackend.php index 7ee82779849..c819fa6afc6 100644 --- a/apps/dav/lib/Files/FileSearchBackend.php +++ b/apps/dav/lib/Files/FileSearchBackend.php @@ -55,6 +55,8 @@ use SearchDAV\Query\Order; use SearchDAV\Query\Query; class FileSearchBackend implements ISearchBackend { + const OPERATOR_LIMIT = 100; + /** @var CachingTree */ private $tree; @@ -315,6 +317,11 @@ class FileSearchBackend implements ISearchBackend { } } + $operatorCount = $this->countSearchOperators($query->where); + if ($operatorCount > self::OPERATOR_LIMIT) { + throw new \InvalidArgumentException('Invalid search query, maximum operator limit of ' . self::OPERATOR_LIMIT . ' exceeded, got ' . $operatorCount . ' operators'); + } + return new SearchQuery( $this->transformSearchOperation($query->where), (int)$limit->maxResults, @@ -325,6 +332,26 @@ class FileSearchBackend implements ISearchBackend { ); } + private function countSearchOperators(Operator $operator): int { + switch ($operator->type) { + case Operator::OPERATION_AND: + case Operator::OPERATION_OR: + case Operator::OPERATION_NOT: + /** @var Operator[] $arguments */ + $arguments = $operator->arguments; + return array_sum(array_map([$this, 'countSearchOperators'], $arguments)); + case Operator::OPERATION_EQUAL: + case Operator::OPERATION_GREATER_OR_EQUAL_THAN: + case Operator::OPERATION_GREATER_THAN: + case Operator::OPERATION_LESS_OR_EQUAL_THAN: + case Operator::OPERATION_LESS_THAN: + case Operator::OPERATION_IS_LIKE: + case Operator::OPERATION_IS_COLLECTION: + default: + return 1; + } + } + /** * @param Order $order * @return ISearchOrder -- cgit v1.2.3