Merge commit from fork

The public `sortDirection` Livewire property was interpolated verbatim into
raw ORDER BY clauses, allowing SQL injection through POST /livewire/update.

A direction keyword cannot be a bound parameter, so it must be interpolated
as a literal — the fix restricts it to a strict asc/desc allowlist via a new
`Sql::sanitizeSortDirection()` helper, applied both at the source (the
property) and at the two raw-SQL sinks:

- naturalSort: ColumnRawQueries resolves {sortDirection} to a sanitized value
  (the advisory path; fires even when sortField is empty).
- sortUsing/sortCallback: Database\Pipelines\Sorting sanitizes the direction
  before handing it to developer closures that may build orderByRaw.
- source: sortBy(), updatedSortDirection() and Persist::restoreState() now
  normalize the property (covers the Livewire update vector and tampered
  persisted state).

Laravel's orderBy() already validates the direction, so the plain (non-raw)
paths were not injectable; normalizing there also prevents a 500 on tampered
input.

Author: luanfreitasdev

src/Concerns/Persist.php

@@ -4,6 +4,7 @@
 
 use Exception;
 use Illuminate\Support\Facades\{Cache, Cookie, Session};
+use PowerComponents\LivewirePowerGrid\DataSource\Support\Sql;
 use PowerComponents\LivewirePowerGrid\PowerGridComponent;
 use Psr\SimpleCache\InvalidArgumentException;
 
@@ -99,7 +100,7 @@ private function restoreState(): void
 
         if (in_array('sorting', $this->persist) && array_key_exists('sortField', $state)) {
             $this->sortField = $state['sortField'];
-            $this->sortDirection = $state['sortDirection'];
+            $this->sortDirection = Sql::sanitizeSortDirection($state['sortDirection'] ?? null);
             $this->sortArray = $state['sortArray'];
             $this->multiSort = $state['multiSort'];
         }

src/Concerns/Sorting.php

@@ -4,6 +4,7 @@
 
 use Exception;
 use PowerComponents\LivewirePowerGrid\Column;
+use PowerComponents\LivewirePowerGrid\DataSource\Support\Sql;
 use stdClass;
 
 trait Sorting
@@ -27,7 +28,7 @@ public function sortBy(string $field, string $direction = 'asc'): void
             return;
         }
 
-        $this->sortDirection = $this->sortField === $field ? $this->reverseSort() : $direction;
+        $this->sortDirection = $this->sortField === $field ? $this->reverseSort() : Sql::sanitizeSortDirection($direction);
 
         $this->sortField = $field;
 
@@ -102,6 +103,8 @@ public function sortIcon(string $field): string
 
     public function updatedSortDirection(): void
     {
+        $this->sortDirection = Sql::sanitizeSortDirection($this->sortDirection);
+
         if ($this->hasLazyEnabled) {
             data_set($this->setUp, 'lazy.items', 0);
 

src/DataSource/Processors/Database/Pipelines/ColumnRawQueries.php

@@ -6,6 +6,7 @@
 use Illuminate\Database\Eloquent\Builder as EloquentBuilder;
 use Illuminate\Database\Eloquent\Relations\MorphToMany;
 use Illuminate\Database\Query\Builder as QueryBuilder;
+use PowerComponents\LivewirePowerGrid\DataSource\Support\Sql;
 use PowerComponents\LivewirePowerGrid\PowerGridComponent;
 
 class ColumnRawQueries
@@ -62,6 +63,13 @@ private function resolvePlaceholders(?string $sql): ?string
         return preg_replace_callback('/\{(\w+)\}/', function ($matches) {
             $property = trim($matches[1]);
 
+            // The sort direction is interpolated verbatim into a raw ORDER BY
+            // clause, so it must be restricted to an "asc"/"desc" allowlist to
+            // prevent SQL injection through the public sortDirection property.
+            if ($property === 'sortDirection') {
+                return Sql::sanitizeSortDirection($this->component->sortDirection);
+            }
+
             return data_get($this->component, $property, '');
         }, $sql);
     }

src/DataSource/Processors/Database/Pipelines/Sorting.php

@@ -6,6 +6,7 @@
 use Illuminate\Database\Eloquent\Builder as EloquentBuilder;
 use Illuminate\Database\Eloquent\Relations\MorphToMany;
 use Illuminate\Database\Query\Builder as QueryBuilder;
+use PowerComponents\LivewirePowerGrid\DataSource\Support\Sql;
 use PowerComponents\LivewirePowerGrid\PowerGridComponent;
 
 class Sorting
@@ -31,6 +32,10 @@ public function handle(mixed $query, Closure $next): mixed
 
     private function applySingleSort(EloquentBuilder|MorphToMany|QueryBuilder $query, string $sortField, string $direction): void
     {
+        // A sort callback may interpolate the direction into a raw ORDER BY
+        // (e.g. orderByRaw), so it must be restricted to "asc"/"desc" here.
+        $direction = Sql::sanitizeSortDirection($direction);
+
         $sortCallback = $this->component->getSortCallback($sortField);
 
         if ($sortCallback !== null) {
@@ -45,6 +50,8 @@ private function applySingleSort(EloquentBuilder|MorphToMany|QueryBuilder $query
     private function applyMultipleSort(EloquentBuilder|MorphToMany|QueryBuilder $results): void
     {
         foreach ($this->component->sortArray as $sortField => $direction) {
+            $direction = Sql::sanitizeSortDirection($direction);
+
             $sortCallback = $this->component->getSortCallback($sortField);
 
             if ($sortCallback !== null) {

src/DataSource/Support/Sql.php

@@ -114,6 +114,20 @@ public static function isValidSortFieldType(?string $sortFieldType): bool
         return in_array($sortFieldType, self::$sortStringNumberTypes);
     }
 
+    /**
+     * Restrict a sort direction to a strict "asc"/"desc" allowlist.
+     *
+     * The direction keyword is interpolated verbatim into raw ORDER BY clauses
+     * (it cannot be a bound parameter), so anything outside the allowlist must
+     * be normalized to prevent SQL injection. Defaults to "asc".
+     */
+    public static function sanitizeSortDirection(?string $direction): string
+    {
+        $direction = strtolower(trim((string) $direction));
+
+        return in_array($direction, ['asc', 'desc'], true) ? $direction : 'asc';
+    }
+
     /**
      * @throws Exception
      */

tests/Concerns/Components/DishesNaturalSortTable.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace PowerComponents\LivewirePowerGrid\Tests\Concerns\Components;
+
+use Illuminate\Database\Eloquent\Builder;
+use PowerComponents\LivewirePowerGrid\{Column, Facades\PowerGrid, PowerGridComponent, PowerGridFields};
+use PowerComponents\LivewirePowerGrid\Tests\Concerns\Models\Dish;
+
+class DishesNaturalSortTable extends PowerGridComponent
+{
+    public string $tableName = 'dishes-natural-sort-table';
+
+    public bool $ignoreTablePrefix = true;
+
+    public function setUp(): array
+    {
+        return [
+            PowerGrid::header()
+                ->showSearchInput(),
+
+            PowerGrid::footer()
+                ->showPerPage()
+                ->showRecordCount(),
+        ];
+    }
+
+    public function datasource(): Builder
+    {
+        return Dish::query();
+    }
+
+    public function fields(): PowerGridFields
+    {
+        return PowerGrid::fields()
+            ->add('id')
+            ->add('name')
+            ->add('stored_at');
+    }
+
+    public function columns(): array
+    {
+        return [
+            Column::make('Id', 'id')
+                ->sortable(),
+
+            Column::make('Name', 'name')
+                ->sortable(),
+
+            Column::make('Stored at', 'stored_at')
+                ->naturalSort(true),
+
+            Column::action('Action'),
+        ];
+    }
+
+    public function setTestThemeClass(string $themeClass): void
+    {
+        config(['livewire-powergrid.theme' => $themeClass]);
+    }
+}

tests/Feature/Helpers/SqlSupportTest.php

@@ -52,3 +52,18 @@
     [['db' => 'sqlsrv', 'version' => '20.80',  'expected' => "CAST(SUBSTRING(field, PATINDEX('%[a-z]%', field), LEN(field)-PATINDEX('%[a-z]%', field)) AS INT) {sortDirection}"]],
     [['db' => 'unsupported-db', 'version' => '29.00.00',  'expected' => 'field+0 {sortDirection}']],
 ]);
+
+it('restricts the sort direction to an asc/desc allowlist', function (?string $input, string $expected) {
+    expect(Sql::sanitizeSortDirection($input))->toBe($expected);
+})->with([
+    'asc' => ['asc', 'asc'],
+    'desc' => ['desc', 'desc'],
+    'uppercase asc' => ['ASC', 'asc'],
+    'uppercase desc' => ['DESC', 'desc'],
+    'trims surrounding space' => [' desc ', 'desc'],
+    'empty string' => ['', 'asc'],
+    'null' => [null, 'asc'],
+    'unknown keyword' => ['foo', 'asc'],
+    'time-based injection' => ['asc, (SELECT SLEEP(3))', 'asc'],
+    'quote break-out' => ["asc'; DROP TABLE users; --", 'asc'],
+]);

tests/Feature/SortDirectionInjectionTest.php

@@ -0,0 +1,58 @@
+<?php
+
+use PowerComponents\LivewirePowerGrid\DataSource\Processors\Database\Pipelines\{ColumnRawQueries, Sorting};
+use PowerComponents\LivewirePowerGrid\Tests\Concerns\Components\{DishesCustomSortTable, DishesNaturalSortTable};
+use PowerComponents\LivewirePowerGrid\Tests\Concerns\Models\Dish;
+
+use function PowerComponents\LivewirePowerGrid\Tests\Plugins\livewire;
+
+/*
+| Regression tests for GHSA-7fgc-3h6c-698r — SQL injection through the public
+| sortDirection Livewire property. The direction reaches raw ORDER BY clauses
+| through two paths (naturalSort and sortUsing callbacks); both must be
+| restricted to an asc/desc allowlist.
+*/
+
+$payload = 'asc, (SELECT SLEEP(3))';
+
+it('neutralizes SQL injection through sortDirection on a naturalSort column', function () use ($payload) {
+    $component = new DishesNaturalSortTable();
+
+    // The advisory bypass: an empty sortField skips the Sorting pipeline, but
+    // ColumnRawQueries still applies the naturalSort orderByRaw unconditionally.
+    $component->sortField = '';
+    $component->sortDirection = $payload;
+
+    $query = Dish::query();
+
+    (new ColumnRawQueries($component))->handle($query, fn ($q) => $q);
+
+    expect($query->toSql())
+        ->not->toContain('SLEEP')
+        ->toContain(' asc');
+});
+
+it('neutralizes SQL injection through sortDirection in a custom sort callback', function () use ($payload) {
+    $component = new DishesCustomSortTable();
+
+    // The "price" column uses sortUsing() with orderByRaw("... {$direction}").
+    $component->sortField = 'price';
+    $component->sortDirection = $payload;
+
+    $query = Dish::query();
+
+    (new Sorting($component))->handle($query, fn ($q) => $q);
+
+    expect($query->toSql())->not->toContain('SLEEP');
+});
+
+it('normalizes a tampered sortDirection to asc through the Livewire lifecycle', function () use ($payload) {
+    // Reproduces the exact advisory request: sortField="" + a malicious
+    // sortDirection sent via /livewire/update. The updatedSortDirection hook
+    // must normalize it, and the render (which runs the naturalSort query)
+    // must not fail with a SQL error.
+    livewire(DishesNaturalSortTable::class)
+        ->set('sortField', '')
+        ->set('sortDirection', $payload)
+        ->assertSet('sortDirection', 'asc');
+});