Sanitization of the q parameter

Question

I'm using Drupal 7. My question regards the sanitization of the "q" parameter. We know about SQL injection, so I was wondering if this parameter may be a vector for this kind of security flaw. I've searched the Drupal core files for the $_GET['q'] string. It is used several times but I could't find any kind of sanitization. Perhaps I've missed something.

My opinion is that Drupal does not uses the $_GET['q'] inside any kind of query or if it does it will be sanitized by the database API itself.

Answer 1

Actually, Drupal uses $_GET['q'] for querying the database, but since it uses its own functions for querying the database, there isn't any risk of SQL injection.

function drupal_path_initialize() {

  // Ensure $_GET['q'] is set before calling drupal_normal_path(), to support
  // path caching with hook_url_inbound_alter().
  if (empty($_GET['q'])) {
    $_GET['q'] = variable_get('site_frontpage', 'node');
  }
  $_GET['q'] = drupal_get_normal_path($_GET['q']);

drupal_get_normal_path() is the function querying the database, via drupal_lookup_path(), which contains the following code.

      if ($path_language == LANGUAGE_NONE) {
        // Prevent PDO from complaining about a token the query doesn't use.
        unset($args[':language']);
        $result = db_query('SELECT source, alias FROM {url_alias} WHERE source IN (:system) AND language = :language_none ORDER BY pid ASC', $args);
      }
      elseif ($path_language < LANGUAGE_NONE) {
        $result = db_query('SELECT source, alias FROM {url_alias} WHERE source IN (:system) AND language IN (:language, :language_none) ORDER BY language ASC, pid ASC', $args);
      }
      else {
        $result = db_query('SELECT source, alias FROM {url_alias} WHERE source IN (:system) AND language IN (:language, :language_none) ORDER BY language DESC, pid ASC', $args);
      }

On Drupal, you won't find code that sanitizes a value entered from a user to avoid SQL injection when the value isn't used in a database query. You won't find any $_GET['q'] = sanitize_for_sql_injection($_GET['q']); line or similar lines.

Answer 2

The request sanitization is an important part of Drupal security. Probably you can find the most important code in the DrupalRequestSanitizer class.

Here you have the sanitize method:

 /**
   * Modifies the request to strip dangerous keys from user input.
   */
  public static function sanitize() {
    if (!self::$sanitized) {
      $whitelist = variable_get('sanitize_input_whitelist', array());
      $log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);

      // Process query string parameters.
      $get_sanitized_keys = array();
      $_GET = self::stripDangerousValues($_GET, $whitelist, $get_sanitized_keys);
      if ($log_sanitized_keys && $get_sanitized_keys) {
        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from query string parameters (GET): @keys', array('@keys' => implode(', ', $get_sanitized_keys))), E_USER_NOTICE);
      }

      // Process request body parameters.
      $post_sanitized_keys = array();
      $_POST = self::stripDangerousValues($_POST, $whitelist, $post_sanitized_keys);
      if ($log_sanitized_keys && $post_sanitized_keys) {
        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from request body parameters (POST): @keys', array('@keys' => implode(', ', $post_sanitized_keys))), E_USER_NOTICE);
      }

      // Process cookie parameters.
      $cookie_sanitized_keys = array();
      $_COOKIE = self::stripDangerousValues($_COOKIE, $whitelist, $cookie_sanitized_keys);
      if ($log_sanitized_keys && $cookie_sanitized_keys) {
        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from cookie parameters (COOKIE): @keys', array('@keys' => implode(', ', $cookie_sanitized_keys))), E_USER_NOTICE);
      }

      $request_sanitized_keys = array();
      $_REQUEST = self::stripDangerousValues($_REQUEST, $whitelist, $request_sanitized_keys);

      self::$sanitized = TRUE;
    }
  }

There a few more functions but this one is the most important.

As you think sanitizing request input is very important. One of the worst Drupal core issues were related to this (in fact, this file was patched, if I'm not wrong). See "Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002" security report.

Implications

Given Drupal has a Security Team you don't have to worry about request sanitization unless you develop your own code that deals directly with the request.