Skip to content

Surf 1405: More Cypher injection clean up - #968

Merged
gem-neo4j merged 2 commits into
devfrom
surf-1405
Sep 10, 2026
Merged

gem-neo4j merged 2 commits into
devfrom
surf-1405

Conversation

@gem-neo4j

Copy link
Copy Markdown
Contributor

I followed Joels comment on my last PR and decided to update everything to use the safer way of sanitizing, but APOC extended uses the old way, so I left it for them with a comment.

Linear: fixes: SURF-1405, SURF-1436

.collect(Collectors.joining("|"));
String key = StreamSupport.stream(keys.spliterator(), false)
.map(s -> String.format(PROPERTY_QUOTING_FORMAT, "n", s))
.map(s -> String.format(PROPERTY_QUOTING_FORMAT, "n", s.replace("`", "``")))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a particular reason this uses a hand crafted escape? Same with the one further down.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah true, should probably use the sanitize function :) will update

}

public static String quoteIdentifierSafely(String value) {
if (SourceVersion.isIdentifier(value) && !value.contains("$")) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unrelated to your change but this !var.contains("$") I guess is some kind of parameter quick escape? E.g. you don't want to quote the param $parameter. If that's the case - won't it behave weirdly with input that has $ in the variable name? var$name?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, the SourceVersion.isIdentifier doesn't include dollar signs, so it checks if the string contains that and then quotes it. So var$name would always be quoted which is correct behaviour

}

// This is in common, so I suspect this is used by extended, leaving as is, please use quoteIdentifierSafely
// instead.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there a way to warn us when invoking this method? perhaps an annotation saying that its deprecated with a pointer to the quoteIdentifierSafely method. it might not be possible since the quote method seem to be used elsewhere, and is not in fact considered deprecated

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can add a deprecated, the reason it stays is because the common module is shared by the APOC extended repo, so if I remove it they may get failures there all of a sudden :)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think that makes sense, its not a blocker for me so you can decide. just wanted to point out that there might a chance that its overlooked ( :

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have already added it :P would you like to approve the PR if you're happy?

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh my bad, it was my intention to write this comment & approve PR at the same time!

@gem-neo4j
gem-neo4j merged commit 5e82a28 into dev Sep 10, 2026
7 checks passed
@gem-neo4j
gem-neo4j deleted the surf-1405 branch September 10, 2026 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants