Skip to content

hardening: migrate monitor SQL helpers to prepared variants#208

Open
somethingwithproof wants to merge 3 commits intoCacti:developfrom
somethingwithproof:fix/prepared-monitor-sql-207
Open

hardening: migrate monitor SQL helpers to prepared variants#208
somethingwithproof wants to merge 3 commits intoCacti:developfrom
somethingwithproof:fix/prepared-monitor-sql-207

Conversation

@somethingwithproof
Copy link

Summary

Implements issue #207 by migrating selected raw monitor SQL helpers to prepared variants in setup.php.

Changes

  • migrated plugin version lookup in monitor_check_upgrade() to db_fetch_cell_prepared()
  • migrated uninstall table-drop calls in plugin_monitor_uninstall() to db_execute_prepared()
  • migrated monitor_device_remove() deletes to placeholder-based prepared statements using IN (...)
  • added standalone regression test: tests/test_prepared_statements.php

Validation

  • php -l setup.php
  • php -l tests/test_prepared_statements.php
  • php tests/test_prepared_statements.php

Issue

Closes #207

Copilot AI review requested due to automatic review settings March 15, 2026 23:46
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Hardens the monitor plugin by migrating a few remaining raw SQL helper call sites in setup.php to prepared-statement variants, plus adds a lightweight regression script intended to prevent reintroducing those raw patterns.

Changes:

  • Switched plugin version lookup in monitor_check_upgrade() to db_fetch_cell_prepared() with a bound placeholder.
  • Switched uninstall table drops and monitor_device_remove() cleanup deletes to db_execute_prepared(), using generated IN (?, ?, ...) placeholders for multi-device removal.
  • Added a standalone PHP regression script under tests/ that string-checks for prepared helper usage in setup.php.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File Description
setup.php Replaces selected raw SQL calls with prepared helper variants; adds placeholder-based IN (...) deletes.
tests/test_prepared_statements.php Adds a standalone regression script that asserts prepared-helper usage patterns in setup.php.

You can also share your feedback on Copilot code review. Take the survey.

Comment on lines +17 to +21
$setup = file_get_contents(__DIR__ . '/../setup.php');
if ($setup === false) {
fwrite(STDERR, "Unable to read setup.php\n");
exit(1);
}
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 0e8344b: added a CI step in plugin-ci-workflow.yml to execute tests/test_*.php when present.

setup.php Outdated
Comment on lines +160 to +162
db_execute_prepared('DROP TABLE IF EXISTS plugin_monitor_notify_history');
db_execute_prepared('DROP TABLE IF EXISTS plugin_monitor_reboot_history');
db_execute_prepared('DROP TABLE IF EXISTS plugin_monitor_uptime');
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — updated in 0e8344b to pass explicit empty bindings ([]) for those prepared uninstall calls.

Comment on lines +25 to +26
"db_fetch_cell_prepared(\n\t\t'SELECT version",
'Expected plugin version lookup to use db_fetch_cell_prepared().'
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated in 0e8344b to use less brittle assertions (regex/tolerant matching) rather than whitespace-sensitive exact strings.

'db_execute(\'DELETE FROM plugin_monitor_notify_history WHERE host_id IN(\' . implode(\',\', $devices) . \')\');',
'Raw notify-history delete should not remain.'
);

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 0e8344b: added negative assertions for reboot and uptime raw-delete patterns as well.

@somethingwithproof
Copy link
Author

somethingwithproof commented Mar 16, 2026

Incorporated follow-up feedback in b8d2904. Added follow-up edge-case checks for empty device short-circuit and integer normalization before prepared deletes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

hardening: migrate monitor SQL helpers to prepared variants

2 participants