FOUR-33091: Fix SQL Injection in ProcessMaker 4 advanced_filter

[caleeli]

Issue & Reproduction Steps

advanced_filter allows any raw using the function raw(...).

Solution

• Restrict restrict advanced_filter to validated temporal expressions, approved fields, and safe comparison operators.
• The allowed fields:
  • created_at
  • updated_at
  • initiated_at
  • completed_at
  • due_at
  • started_at
• The allowed operators:
  • =
  • !=
  • <

  • =

  • <=
  • between

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-33091

ci:deploy

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[nolanpro]

QA server K8S was successfully deployed https://ci-f2ef5fdaf7.engk8s.processmaker.net

[ryancooley]

cursor review

[cursor]

PR Summary

High Risk
This is a security fix on user-controlled advanced_filter SQL generation; incorrect validation could break legitimate date filters or leave injection gaps.

Overview
Closes an SQL injection path where advanced_filter accepted arbitrary content inside raw(...) and passed it into queries.

Raw value handling is rewritten so only raw(NOW()) and optional ± INTERVAL n UNIT forms are accepted (interval capped at 365), with 422 responses for invalid expressions, bad operators, or malformed between values. between is now a supported raw operator, including two raw bounds.

Context rules in BaseFilter limit raw usage on non-JSON fields to an allowlist of temporal columns (created_at, due_at, etc.); JSON data.* fields can still compare against validated NOW() expressions. JSON comparisons embed raw SQL via the query grammar when the value is an Expression.

Coverage adds unit and API tests for intervals, between, rejection of subquery payloads, and PHPUnit attribute grouping on ProcessRequestsTest.

^{Reviewed by Cursor Bugbot for commit 9e23cf3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9e23cf3. Configure here.}